Under the Digital Personal Data Protection Act, 2023 (β€œDPDPA”), the lawful grounds for processing of personal data are (a) consent, and (b) certain legitimate uses (a broad concept that includes other grounds for processing personal data).

This article aims to provide an overview of the grounds of processing and provides practical recommendations for businesses to identify the appropriate legal basis in compliance with the Indian data protection law.