Section 14 Indian Data Protection Act 2019

Processing of personal data for other reasonable purposes

14. (1) In addition to the grounds referred to under sections 12 and 13, the personal data may be processed without obtaining consent under section 11, if such processing is necessary for such reasonable purposes as may be specified by regulations, after taking into consideration

(a) the interest of the data fiduciary in processing for that purpose;

(b) whether the data fiduciary can reasonably be expected to obtain the consent of the data principal;

(c) any public interest in processing for that purpose;

(d) the effect of the processing activity on the rights of the data principal; and

(e) the reasonable expectations of the data principal having regard to the context of the processing.

(2) For the purpose of sub-section (1), the expression “reasonable purposes” may include

(a) prevention and detection of any unlawful activity including fraud;

(b) whistle blowing;

(c) mergers and acquisitions;

(d) network and information security;

(e) credit scoring;

(f) recovery of debt;

(g) processing of publicly available personal data; and

(h) the operation of search engines.

(3) Where the Authority specifies a reasonable purpose under sub-section (1), it shall

(a) lay down, by regulations, such safeguards as may be appropriate to ensure the protection of the rights of data principals; and

(b) determine where the provision of notice under section 7 shall apply or not apply having regard to the fact whether such provision shall substantially prejudice the relevant reasonable purpose.