Data
A representation of information, facts, concepts, opinions or instructions that a person or a computer can communicate, interpret or process.
"Data" is any recorded information, whether facts, opinions, instructions or numbers, in a form a person or a computer can read or process. It only becomes a data-protection matter when it is about an identifiable individual.
Meaning of Data
The DPDP Act uses a very wide meaning of "data". A spreadsheet, a database row, a photo, a voice note and a log file are all data. Data becomes [personal data](term/personal-data) only when it relates to an identifiable individual.
Section 2(h) of the DPDP Act 2023 defines data as a representation of information, facts, concepts, opinions or instructions, in a manner suitable for communication, interpretation or processing by human beings or by automated means. The definition is deliberately broad and technology-neutral. It does not care whether the information sits in a database, a PDF, a CCTV frame, a voice recording or a chat message. If it can be stored and read back, it is data.
The width of this definition matters because the rest of the Act builds on it. "Personal data" in Section 2(t) is simply data about an individual who is identifiable, and "digital personal data" in Section 2(n) is personal data in digital form. So every compliance duty starts by asking a quiet first question: is what we hold data at all, and is it about a person? Most business records, from invoices to support tickets, pass both tests.
Not all data attracts the Act. A table of average basket sizes by city, a set of weather readings, a published bus timetable or a code repository with no customer information is data, but it is not personal data, so Sections 4 to 17 do not apply to it. The same dataset can move across the line. Sales totals are harmless; the same totals broken down by named customer are personal data from that moment.
Two neighbouring ideas are easy to confuse with "data". Information in the Right to Information Act sense is about public records held by public authorities, and the DPDP Act does not replace it. The older IT Act 2000 also defines "data" in Section 2(1)(o), and the DPDP Act uses its own definition for its own purposes. When you read a contract or policy, check which law's definition the document is relying on.
Examples of Data
A table of monthly sales totals is data. A table of customer names with the amounts each one spent is personal data.
A retailer exports last quarter's sales into a dashboard showing revenue by product category and state. The dashboard is data but not personal data. The underlying order table, with names, addresses and phone numbers, is personal data and sits under the full set of obligations.
A hospital's bed-occupancy statistics by ward are operational data. The admission register and imaging files are data about identifiable patients. The administrator keeps the two in separate systems so statistics can be shared with the state health department without exposing individuals.
A start-up stores application logs that include an error code, a timestamp and a user ID. Logs look technical, but the user ID links back to an account holder, so the team treats the log store as personal data and sets access limits and a [retention period](term/retention-period).
Why Data matters
Understanding "data" at this basic level prevents two opposite errors. Some teams treat everything as personal data and lock down harmless operational information, wasting effort and slowing the business. Others assume that raw, unlabelled files, logs or exports are "just data" and leave them unprotected, even though they contain mobile numbers, device identifiers or free-text comments about named people. Penalties under Section 33 and the Schedule, which can reach ₹250 crore for failing to maintain reasonable security safeguards, are tied to personal data, so classification decides exposure.
For individuals, the definition explains why a photograph, a payment record or a location trail is protected even when no form was filled in. For organisations, it explains why a data inventory must look beyond databases to shared drives, messaging groups, backups, scanned papers and vendor portals.
How it works in practice
- 1Start with a data inventory. List every place information is created or stored: applications, spreadsheets, email inboxes, mobile devices, cloud buckets, CCTV systems and paper archives that are scanned later.
- 2For each store, record what categories of information it holds and mark whether any field relates to an identifiable individual. This simple yes/no tag is what separates ordinary business data from personal data.
- 3Look for indirect identifiers hiding in "non-personal" datasets, such as employee IDs, vehicle numbers, device IDs, IP addresses and postcodes combined with age or occupation. Combination can make an individual identifiable.
- 4Apply different handling tiers. Truly non-personal data can follow normal business rules, while data tagged as personal enters the notice, consent, retention, security and breach processes.
- 5Review the inventory when a new tool, vendor or campaign is introduced, because new data flows are the usual way an unreviewed personal-data store appears.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating "data" and "personal data" as the same thing. The Act only regulates the second; classify each dataset before applying controls.
Assuming that data without a name is automatically anonymous. A phone number, device ID or employee code can still identify someone, so test for identifiability rather than looking only for a name column.
Counting only databases. Spreadsheets on laptops, WhatsApp exports and emailed attachments are data too and should appear in the inventory.
Relying on the IT Act definition of data when drafting DPDP policies. Use the Section 2(h) definition and wording in notices and contracts.
Compliance tips
Keep a living data map and name an owner for each system, so questions about what is held can be answered quickly.
Tag fields at design time. When building a new form or table, mark each field as personal or non-personal and record why it is needed.
Treat combined datasets with care: joining two harmless tables can create personal data, so review before merging or sharing externally.
Train non-technical staff using everyday examples such as photos, chat messages and exports, since they rarely think of these as "data".
Common questions about Data
Is every kind of data covered by the DPDP Act?
No. The Act regulates digital personal data. Non-personal data, such as aggregated statistics, weather readings or product catalogues, falls outside it, although other laws, contracts or confidentiality duties may still apply to that data.
Does the DPDP Act define data differently from the IT Act?
Both define it broadly, but each law uses its own wording for its own purposes. The DPDP Act's definition in Section 2(h) is the one that applies when you assess duties under the DPDP Act and Rules.
Is a photograph or voice recording "data" under the Act?
Yes. The definition covers any representation of information that can be communicated or processed, so images, audio and video all qualify. If the person in the recording is identifiable, it is also personal data.
Is anonymised data still covered?
Data that has been irreversibly stripped of any link to individuals is generally not personal data. If the person can still be identified by combining it with other information, treat it as personal data and keep the safeguards.