Legal Register
ACT-4 Tranche 3 (13 May 2027) — Core Operating Cliff
Status: scheduled, not yet operative
Section 4: Processing
Contract, reasonable business purposes and vendor consent hashes are not a third freestanding ground.
Regulated Actor: Person processing personal data
Gazette Baseline: Lines 160–166
Statutory Trigger
Processing
Applies to: Person processing personal data
Substantive Conditions
Lawful purpose plus consent or a section 7 use.
Statutory Exceptions
Subject to other applicable provisions and exemptions.
Official Gazette Text (Verbatim Publication)
Ministry of Law and Justice publication, Digital Personal Data Protection Act, 2023.
Grounds for 4. (1) A person may process the personal data of a Data Principal only in accordance
processing with the provisions of this Act and for a lawful purpose,—
personal data.
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression “lawful purpose” means any
purpose which is not expressly forbidden by law.
Mapped Operational Controls (1)
Enterprise obligations in the Control Master Matrix grounded in this statutory provision.