Digitised Personal Data
Personal data first collected in non-digital form (such as paper) and later converted into digital form.
Digitised personal data is information first collected on paper or another non-digital form and later converted into digital form. Once converted, the DPDP Act covers it.
Meaning of Digitised Personal Data
The Act applies to personal data collected in non-digital form and then digitised. This closes the gap that would otherwise let organisations avoid the law by collecting data on paper and scanning or typing it in later.
Section 3(a)(ii) of the DPDP Act applies the law to personal data collected in non-digital form and digitised subsequently. The Act does not define "digitised data" as a separate term, but this wording makes clear that the original format does not decide coverage. What counts is whether the personal data now exists in a digital form that a Data Fiduciary processes.
The provision closes a loophole. Without it, an organisation could collect information through paper forms, hand-written registers and verbal records, and keep those outside the law, while still using the details in a computer later for marketing or analytics. By pulling digitised data in, the Act treats a customer who filled a printed form like a customer who used an app.
There is a timing question. The obligations attach to the digital processing, not to the earlier paper step, which the Act does not regulate directly. In practice that distinction is thin, because the notice duty under Section 5 and the consent rules in Section 6 expect the individual to know why details are being collected. A sensible organisation gives the notice at the counter, as paper intake feeds the digital system.
Digitisation covers scanning, optical character recognition, manual typing, photographing a document, audio transcription of a call that was originally unrecorded, and conversion of microfilm into searchable files. It also covers older paper archives that an organisation now moves to cloud storage. Those legacy files may hold information on people who never saw a modern privacy notice, which raises retention and erasure questions.
Examples of Digitised Personal Data
A hospital collects a patient's details on a paper form at the front desk. When the receptionist enters them into the hospital software, the digitised data is covered.
A hospital collects details on a paper registration form and later keys them into its software. From that point the digital record is covered. The hospital includes a short notice on the form and limits access to clinical and billing staff.
A property dealer collected buyer ID copies in files for ten years and now moves the files to a cloud drive. The digitised files are covered, so the firm deletes copies of buyers whose deals closed beyond the legal [retention period](term/retention-period) and protects the rest with access controls.
A branch scans loan application files so head office can review them. The scans become digitised personal data, and the bank applies its security policy, sends them only through its approved system and records who accessed them.
Why Digitised Personal Data matters
India has a large paper economy: land records, hospital files, school registers, loan applications, KYC forms and insurance proposals. Large digitisation drives, whether by banks or government offices, can pull millions of records into the Act at a stroke. Weak safeguards on a newly digitised archive may attract the highest penalty tier of up to ₹250 crore for failure of reasonable security safeguards, and an unnoticed leak of scanned files can still trigger the breach intimation duty under Section 8(6).
For individuals, the rule means that data given on paper is not a second-class category. They can ask for access, correction or erasure of the digital copy and expect it to be kept secure.
How it works in practice
- 1Before starting a scanning or data-entry project, define the purpose, the categories of data, the system where the files will sit and who will have access.
- 2Check whether the paper originals contained notices or consents. If not, work out how to inform individuals and, where consent is the ground, obtain valid consent before using the digital data for new purposes.
- 3Apply retention limits to the digitised archive. Do not keep scans of old forms indefinitely just because storage is cheap; erase them when the purpose is served unless a law requires retention.
- 4Secure the scanning chain: restrict scanning stations, encrypt files at rest, log access, and ensure that vendors performing digitisation sign data processing contracts under Section 8(2).
- 5Dispose of paper originals responsibly after digitisation where law allows, using cross-cut shredding, so that duplicates do not remain unprotected.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming old paper archives remain outside the Act after being uploaded. Once digitised, they are covered, including any personal data of people who no longer deal with you.
Outsourcing scanning without a contract. The Data Fiduciary remains responsible for the vendor's handling under Section 8(1).
Keeping both paper and digital copies forever. Define a disposal rule for each.
Giving no notice because the data came on a paper form. People should know what you will do with their information however it arrived.
Compliance tips
Include a short notice on printed forms, with a QR code or link to the full privacy notice.
Run a pilot batch through your digitisation workflow and test access control and logging before the full archive moves.
Remove sensitive paper trays from open areas and apply a clear-desk policy in intake teams.
Review historic archives with legal counsel to decide what must be kept, what can be deleted and what can be anonymised.
Common questions about Digitised Personal Data
Does the DPDP Act cover scanned documents?
Yes. If the scanned document contains personal data that was collected in non-digital form and is now digital, Section 3(a) brings it within the Act. The organisation holding the scan must protect it and follow retention rules.
Are old paper records covered by the Act?
Only once they are digitised. The paper records on their own are outside the Act, but uploading or scanning them brings the digital copy into scope, together with the organisation's duties for security, accuracy and erasure.
Is digitised data different from digital personal data?
Digitised data is a route into the same category. Personal data collected on paper and later made digital is treated as [digital personal data](term/digital-personal-data) from that point, with the same duties as data collected through an app.
Do I need fresh consent for old paper records I digitise?
It depends on the ground you rely on and the purpose. If you use the data for a new purpose that the original consent did not cover, you need a valid ground for it. Seek legal advice on your specific records.