Lawful Processing of Personal Data
Description
Personal data may be processed only for lawful purposes consented to by the data principal or for legitimate uses.
⚠️ Risk Impact
Processing without consent or legitimate-use basis is the foundational DPDP violation. Penalty: ₹50 crore per instance.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Document lawful basis per processing activity. Maintain consent records. Map legitimate-use scenarios per DPDP Section 7.
💀 Real-World Attack Scenario
An e-commerce company processed user health data 'for personalized recommendations' without explicit consent. DPDP enforcement: ₹120 crore penalty + cease processing order.
💰 Cost of Non-Compliance
DPDP Section 4 violations: up to ₹250 crore per violation category.
📋 Audit Questions
- 1.Lawful basis documented per activity?
- 2.Consent records?
- 3.Section 7 legitimate-use scenarios documented?
⚡ Common Pitfalls
- ⛔Bundled consent that doesn't separate purposes
- ⛔Legitimate-use over-relied as catch-all
📈 Business Value
Compliant DPDP processing unlocks India's massive consumer market.
⏱️ Effort Estimate
Per-activity documentation
EchelonGraph maintains processing register
🔗 Cross-Framework References
Automate DPDP Act DPDP-1 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →