When a new purpose needs a new conversation with the customer

A customer database often looks like an opportunity waiting to be used. The operations team collected addresses for delivery; the growth team wants neighbourhood profiles; the product team wants to train a recommendation model. The fact that the data is already stored does not settle whether the proposed use fits the original arrangement.

Under sections 4 to 6 of the DPDP Act, processing needs a lawful purpose and an appropriate ground, while consent relates to the specified purpose and necessary data. As of 22 October 2026, those substantive provisions are scheduled for May 2027 under the commencement notification. The review below is a readiness workflow.

Describe the new use without broad labels

Ask the proposing team to explain what information it will use, which people it concerns, what it will produce and who will receive the result. “Improve our service” is not enough to evaluate a project that creates individual profiles or shares records with a new partner.

Also ask whether identifiable data is needed. A planning question about total delivery demand may be answerable with aggregates. A personalised offer requires a different analysis. Reducing unnecessary identifiability is a design option, but simply removing names does not automatically anonymise a linked dataset.

Keep the proposal specific enough that an engineer or operations colleague could recognise when the activity has gone beyond it. An approved sentence that covers almost anything is difficult to enforce or audit.

Recover the original conversation

Find the relevant notice version and the evidence of the original ground or consent. Check the purpose, data items, collection channel and any subsequent changes. Do not rely solely on today’s privacy policy if customers saw something different when their information was collected.

The final notice rule requires specified purposes and descriptions of the goods, services or uses enabled. Compare that explanation with the proposed activity. Record the similarities and differences rather than simply marking “covered by policy”.

If the business intends to rely on consent, assess whether the existing consent actually covers the proposed purpose. If it does not, prepare the appropriate new notice and request before starting that processing. If another section 7 use is being considered, identify the precise provision and facts supporting it.

A hypothetical delivery-data proposal

Imagine a meal subscription company that collected addresses to deliver meals. It now proposes sharing identifiable delivery histories with a partner selling household products. The partnership is commercially related to the company, but that does not make it the same purpose as delivering the customer’s meals.

The reviewer should ask whether the original notice described that sharing, what ground supports it and whether the information is necessary. A blanket sentence allowing “trusted partner activity” may not answer those questions. The company should not start the transfer merely because the commercial agreement has been signed.

By contrast, an internal report counting deliveries by broad area may be designed without identifiable records. The team still needs to check the aggregation and linking context, but the design question is materially different. A purpose review can improve the project rather than only approve or reject it.

Review retention and access together

A new use can quietly extend a dataset’s life. Records kept for a legal reason after an order ends should not automatically become an active source for a new campaign. The business must assess the new processing separately from the justification for continued storage.

Identify who will gain access, whether new vendors are involved and whether an export creates copies outside the normal controls. The prospective accountability and security duties in section 8 make these operational questions important. A lawful-purpose decision does not eliminate the need for safeguards.

Make the decision reviewable

Keep a short record containing the proposal, original purpose, proposed ground, notice implications, minimisation options, recipients, retention and approval conditions. Name an owner who can confirm that implementation matches the approved activity.

If the answer is uncertain, delay the specific new use while obtaining the needed assessment. This is different from automatically shutting down every existing service. The review should identify exactly which activity is unresolved and which facts would resolve it.

After launch, check a sample of actual outputs and data flows. Teams can unintentionally expand a model, campaign or partnership beyond the original decision. A new-purpose review works when it remains connected to the deployed workflow, not when it becomes a one-time signature on a proposal nobody revisits.