Section 4 Grounds for processing personal data
4. (1) A personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses may process the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf only in accordance with the provisions of this Act and for a lawful purpose,-
(a) for which the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf has given her consent; or
(b) for certain legitimate usesDefined in section 2(d): certain legitimate uses means the uses referred to in section 7.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.