Purpose limitation
Topic: Fundamental Rights and Constitutional Remedies · NCERT: Beyond NCERT
Meaning
Purpose limitation is a basic rule of data protection. Personal data may be used only for the reason it was collected, and not for other, unrelated uses. India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 build it in through consent. The consent notice must stand on its own and must name the specific purpose for which the data is taken. The rule matters because it puts the right to privacy, recognised in the K.S. Puttaswamy case (2017), into practice. Without it, data given for one small task could quietly be used to build a full profile of a person.
Example
Digi Yatra uses face data so that passengers can move through airport checkpoints. Under purpose limitation, a new use of that face data, such as using a domestic travel credential for international travel, needs its own clearly stated purpose in the consent notice. PRS Legislative Research has also warned that the DPDP law lets the State reuse data collected for giving benefits or licences for other purposes. PRS said this weakens purpose limitation.
Don't confuse with
- Data minimisation: this rule is about how much data is collected, meaning only what is truly needed. Purpose limitation is about what the data may be used for after it is collected.