What is purpose limitation?
Purpose limitation is the principle that personal data may be used only for the specific, stated purpose it was collected for — not quietly repurposed for something else. If the purpose changes, you generally need fresh consent.
Educational resource only — not legal advice.
Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the purpose is fixed at collection: the notice states it, and consent is given for it. So a phone number collected to send a delivery update can’t later be used for marketing without a new, separate consent. Purpose limitation also drives retention — once the purpose is served, the data should be erased rather than kept for some future use.
Why it matters to you. For a business, it means data you hold for one reason isn’t a free resource for another. For an individual, it’s the assurance that data you gave for one thing won’t silently fuel another.
What it is not. Purpose limitation isn’t a blanket ban on new uses — it means a new purpose needs its own consent, not that you can never ask.
Collecting personal data from your own customers?
These are the rights your business has to honour. See where you stand with a two-minute self-check — no sign-up, no data stored.
Run the compliance self-check →