Chapter 2 · Obligations of Data Fiduciary
Section 4 - Grounds for processing personal data
The lawful bases on which data may be processedYou cannot process someone's personal data simply because you hold it - you need a lawful ground.
Download full Act (PDF)In plain English
You cannot process someone's personal data simply because you hold it - you need a lawful ground. This section says there are only two: the person's consent, or one of the specific 'legitimate uses' listed in Section 7. On top of that, the purpose itself must be lawful, meaning only that it is not expressly forbidden by law. Notably, there is no open-ended 'legitimate interest' basis like the one in the GDPR.
Sending marketing emails needs consent; a hospital treating you in a medical emergency can instead rely on a legitimate use under Section 7.
Key points
- Personal data may be processed only for a lawful purpose.
- Two grounds only: (a) the Data Principal's consent, or (b) certain legitimate uses under Section 7.
- 'Lawful purpose' means any purpose not expressly forbidden by law.
- There is no broad 'legitimate interest' ground - if it isn't consent or a listed use, you can't process.
Official section text
Section 4. Grounds for processing personal data.
A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose, -
for which the Data Principal has given her consent; or
for certain legitimate uses.
For the purposes of this section, the expression “lawful purpose” means any purpose which is not expressly forbidden by law.