(1) A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and for a lawful purpose,—
(a) for which the Data Principal has given her consent; or
(b) for certain legitimate uses.
(2) For the purposes of this section, the expression "lawful purpose" means any purpose which is not expressly forbidden by law.
Notes / Explanation
You can only process personal data for a lawful purpose. Basically, you either need the user's clear Consent, or it must fall under 'Certain Legitimate Uses' (like emergencies or government services). You can't just take data because you want to.