Purpose limitation sounds abstract until you see it applied to a real example — one the Act itself uses to illustrate the point.
A WORKED EXAMPLE
THE APP
A telemedicine service
It asks for medical details to provide a consultation — a clear, specific, necessary purpose.
THE OVER-ASK
Also requests your contact list
Not needed to deliver a telemedicine consultation at all..
THE LIMIT
Consent doesn't stretch to cover it
Agreeing to the medical processing doesn’t imply agreeing to the contact-list access too.
That’s purpose limitation in one sentence: consent is scoped to what was actually asked for, and it doesn’t quietly expand to cover whatever else an organisation later decides would be useful. If a new use comes up, that’s a new purpose — and it needs its own basis, not a stretch of the old one.
Purpose limitation means treating every new use of data as a new question, not an extension of the last answer.
SOURCES The DPDP Act, 2023 — official text, MeitY — https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdfÂ