Section 4 — Grounds for Processing Personal Data

Section 3 decided whether the Act reaches a given data flow at all. Section 4 is the first substantive rule that applies once it does — and it's a gate, not a menu. A Data Fiduciary may process personal data only in accordance with the Act and for a lawful purpose, and only on one of exactly two grounds: consent, or a use that qualifies as a certain legitimate use. There is no general "legitimate interest" basis of the kind some other privacy laws recognise, and no residual catch-all for processing that's merely convenient or commercially sensible. If neither ground applies, the processing isn't lawful under this Act, full stop.

Two grounds, not a spectrum — 4(1)(a) and 4(1)(b)

Clause (a) is consent — the Data Principal has given her consent to the processing, on the terms Section 6 lays out. Clause (b) is certain legitimate uses — the specific, enumerated list in Section 7, covering situations like voluntarily-provided data, State-delivered benefits, legal compliance, medical emergencies, and defined employment purposes. These aren't two ends of a sliding scale where an organisation picks whichever is easier to argue after the fact — each is a separate, exhaustive basis, and a Data Fiduciary needs to know in advance, for each processing activity, which one it's actually relying on. Reaching for Section 7 because gathering consent felt inconvenient, when the activity doesn't fit any of Section 7's listed uses, isn't a lawful basis — it's processing without one.

"Lawful purpose" is a narrower gate than it sounds — 4(2)

Sub-section (2) defines "lawful purpose" for the purposes of this section as any purpose that is not expressly forbidden by law. That reads permissively — almost anything qualifies unless some other law specifically bans it — but it's easy to mistake for a broader licence than it actually is. Clearing the lawful-purpose bar doesn't clear the consent-or-legitimate-use bar; both conditions in Section 4(1) have to hold together. A purpose can be entirely lawful in the ordinary sense and still be processed unlawfully under this Act, if it's pursued without consent and without fitting any Section 7 category.

Why this matters in practice

Section 4 is the checkpoint most compliance gaps trace back to, because it forces a decision that's easy to defer: for this specific processing activity, which of the two grounds are we actually standing on? Organisations that haven't mapped their processing activities against Section 4 tend to discover, usually during a vendor audit or a rights request, that some data flows were never actually anchored to either ground — they were just running, unexamined, since before anyone asked the question. Doing that mapping activity by activity, rather than assuming "we have a privacy policy so we're covered," is what Section 4 actually requires in substance.

Illustration: a fitness app collects a user's step count with her consent to power the app's core tracking feature — that's Section 4(1)(a). The same app later wants to share aggregated, identifiable user data with an advertising partner. That sharing isn't covered by the original consent, which was specific to the tracking purpose under Section 6(1), and it doesn't fit any Section 7 legitimate use either. The app needs a fresh, specific consent for the advertising use — it can't rely on the first consent stretching to cover it, and it has no legitimate-use basis to fall back on.

How Section 4 connects to the rest of the Act

Section 4 is purely a gateway — it names the two grounds without defining either. Section 5's notice obligation attaches to the consent route specifically, since notice must accompany or precede a consent request under Section 6. Section 6 spells out what makes a consent valid, and Section 7 lists the legitimate uses in full. Everything in Section 8 onward — the general obligations, breach duties, erasure timelines — presumes a Data Fiduciary has already cleared Section 4's gate; it's not a substitute for having done so.