Document Overlap
3.1%
← Content Overlap Report
A-062
→
First documentPurpose Limitation in Practice: How to Stop Teams fromOpen original ↗
A-042
Second documentHandling Legacy Data Collected Before DPDP: A Board-Level PlanOpen original ↗
Low overlap
Top paragraph overlap
48.3%Page comparison
Paragraph matches
Strongest non-zero match for each paragraph.
First paragraph142 words
Common questions about purpose limitation and stopping data reuse
Begin with a focused workshop between product, analytics, privacy, and legal leaders. Map your top five data-heavy journeys, draft an initial set of purposes in business language, and agree a lightweight reuse decision process for the next six months. This creates a foundation you can then formalise into a full catalogue, governance model, and technical controls. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 5 – Principles relating to processing of personal data - European Union / EUR-Lex Privacy principles and OECD Privacy Guidelines - Organisation for Economic Co-operation and Development (OECD) Digital Personal Data Protection Act, 2023 (official text) - Ministry of Electronics and Information Technology, Government of India Digital Personal Data Protection Rules, 2025 - Wikipedia Key Highlights of the Digital Personal Data Protection Act, 2023 - Juris Legal Opinion 03/2013 on purpose limitation - Article 29 Data Protection Working Party (now EDPB)
48.3%
Second paragraph300 words
Executive checklist and common questions on DPDP legacy data
DPDP sits alongside, not above, sectoral and general laws that impose record-keeping duties. If RBI, SEBI, IRDAI, TRAI, or tax statutes require you to retain certain records for a defined number of years, you generally must continue to hold that data even if a Data Principal withdraws consent or asks for erasure, to the extent necessary to meet those legal obligations. Under DPDP, this can operate as a lawful basis under the category of compliance with law or legitimate uses. However, that does not give you a free licence to use the same data for unrelated purposes, such as marketing or broad profiling, once consent is withdrawn or the original purpose has been served. The practical approach is to build and maintain a retention schedule that clearly maps each category of data to its governing laws and minimum retention periods, ensure that fields kept solely for statutory purposes are segregated and access-controlled, and delete or anonymise non-essential fields when they are no longer needed. Where sectoral regulators issue their own privacy or cyber guidelines, align your legacy data programme with those expectations as well, so that you can show both the Data Protection Board and your primary regulator that you have reconciled the two regimes in a thoughtful, documented way. [2] Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India DPDP Rules, 2025 Notified – A Citizen-Centric Framework for Privacy Protection and Responsible Data Use - Press Information Bureau, Government of India Decrypting India’s New Data Protection Law: Key Insights and Lessons Learned - Bird & Bird Top 10 operational impacts of India’s DPDPA – Individual rights - International Association of Privacy Professionals (IAPP) Summary of DSCI’s submission to MeitY on Draft Digital Personal Data Protection Rules, 2025 - Data Security Council of India
First paragraph32 words
From principle to board-level risk: why purpose limitation matters now
Regulatory exposure: GDPR, the OECD Privacy Guidelines, and the DPDP regime all converge on purpose limitation as a foundational principle. A failure here is rarely seen as a minor technical breach. [1]
3.1%
Second paragraph171 words
Executive checklist and common questions on DPDP legacy data
Legacy data is particularly exposed to several DPDP contraventions. Failure to provide proper notices for historic consents or to ensure that ongoing processing is covered by a valid lawful basis can amount to non-compliance with foundational obligations on notice and consent. Because legacy datasets are often large and widely replicated, they are common sources of security incidents; inadequate safeguards or delayed breach notification can attract separate penalties. If your systems cannot locate and act on a Data Principal’s access, correction, or erasure request across legacy archives, you risk violating their rights. Unmanaged data held by processors and vendors on your behalf can lead to vicarious exposure if contracts and controls are weak. The Act’s penalty schedule provides for significant rupee-denominated monetary penalties per type of contravention, with the Data Protection Board expected to consider factors such as the nature and gravity of the breach, the volume and sensitivity of data affected, the duration of non-compliance, and the steps you took to prevent and remedy harm. [1]