Purpose Limitation

Purpose limitation is one of the oldest data protection principles. GDPR Article 5(1)(b) requires personal data to be 'collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes'. The DPDP Act's Section 7(a) frames the same rule as a legitimate-use condition — processing is lawful where the Data Principal voluntarily provided data for the stated purpose. 'Vague' purposes such as 'to improve our services' do not satisfy the specificity requirement.

Further processing for a different purpose requires a new lawful basis — in the EU, this is often fresh consent or an assessment under Article 6(4) that the new purpose is compatible. In practice, purpose limitation is the main brake on repurposing customer data for AI training, product analytics and marketing: the original purpose rarely covers these downstream uses, so each requires its own notice and consent (or legitimate-use fit under DPDP Section 7). A Record of Processing Activities (RoPA) that records purpose per activity is the operational artefact that makes this discipline enforceable.