Section 4. Grounds for processing personal data

CHAPTER II OBLIGATIONS OF DATA FIDUCIARY 4. Grounds for processing personal data .—(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,— (a) for which the Data Principal has given her consent; or (b) for certain legitimate uses. (2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law. 4. The said Bill, inter alia , seeks— (a) to provide for protection of digital personal data; (b) to lay down grounds for processing personal data; (c) to place general and in certain cases special obligations on entities that process personal data; (d) to confer certain rights in respect of their personal down on individuals; (e) to provide for duties to be performed by individuals while exercising their right and providing their personal data for certain purposes; (f) to lay down a digital by design compliance framework for easy and faster implementation of the proposed Legislation; (g) to enable parties to a dispute to attempt resolution of the dispute through alternate process and person of their choice; (h) to provide monetary penalties for lapses and non-compliances to the provisions of the proposed Legislation; and (i) to enable voluntary undertaking to encourage faster resolution and rectification of lapses.