Back to Module
6 of 14|Obligations of Data Fiduciary
video 15 min•Data Management
Purpose Limitation
You cannot use data for purposes the user did not agree to.
🎯 Learning Objectives
- ▸ Understand purpose limitation
- ▸ Analyze function creep and secondary use
The Scope of Purpose
If a user gives you their email address to send them a receipt, you cannot start sending them marketing emails. That is a different purpose. To send marketing emails, you need separate consent.
💡 Example
A fitness app collects heart rate data to show daily health stats. If they want to sell that anonymized data to an insurance company, they must take separate consent for "sharing data with third parties for research/insurance".
📖 Glossary
- Purpose Limitation
- The principle that personal data should only be processed for the purposes specified at the time of collection.
- Function Creep
- The gradual expansion of the use of a technology or data beyond its original purpose.
🔑 Key Takeaways
- Use data only for the reason you collected it.
- If you want to use it for a new purpose, get fresh consent.
- Do not hide data collection behind vague terms like "business purposes".
📚 Further Reading
- DPDPA Section 6 — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...