IP Address
A number that identifies a device on a network.
An IP address is the number that identifies a device or network when it connects to the internet. By itself it looks technical, but when linked to a person's account or internet subscriber record it becomes personal data.
Meaning of IP Address
An IP address can identify a person when combined with other data, such as account or ISP records. It is generally treated as personal data when it relates to an identifiable individual.
An Internet Protocol address is a numeric label that lets computers send data to each other. Your home broadband might give your router one public address, which every device at home shares, or your phone may get a different address each time it connects through a mobile network. Addresses can be static or dynamic, and many people share one through offices, hostels or carrier-grade NAT, which is how the same address can point to hundreds of users.
Whether an IP address is personal data under Section 2 of the DPDP Act depends on whether the person is identifiable "by or in relation to" it. In the hands of a website that also holds a login, a name or a device fingerprint, the address clearly relates to an identifiable person. In the hands of an internet service provider, which can match it to a subscriber at a given time, it is personal data too. A bare address in a lone log line, with no way to link it to anyone, is less clear, and the safe approach is to treat server logs that include addresses as personal data.
Several Indian rules require addresses to be kept. CERT-In directions of 2022 ask service providers and others to retain system logs for 180 days within India, and VPN providers to hold subscriber information for longer. Rule 8 of the DPDP Rules allows retention of logs and traffic data for at least one year for specified purposes, and Rule 6 expects logging and monitoring as part of security safeguards. These are legal reasons to retain, but they do not allow you to reuse the addresses for marketing.
The address is also useful in itself: it supports fraud detection, rate limiting, geo-blocking and approximate location. Using it for those purposes is easier to justify than using it to build an advertising profile. The notice should state that IP addresses are collected and why, and analytics tools that hand addresses to third parties should be named.
Examples of IP Address
A website log that stores a visitor's IP address alongside her account ID contains personal data.
A news site logs visitor addresses for security and sends them to an analytics provider. After reviewing, it enables masking in the analytics tool and keeps full addresses only in a protected security log for the period required.
A bank flags a login from an unusual address and asks the customer to verify. It uses the address only for fraud checks, states this in its notice, and does not feed it into marketing profiles.
A discussion forum stores the address of each poster to handle abuse. It restricts access to two moderators, deletes addresses from old posts after the legal log period, and discloses them to authorities only on a valid legal request.
Why IP Address matters
Underestimating IP addresses causes compliance gaps in places that teams overlook: web server logs, analytics dashboards, support tickets, email headers and security tools. These systems often keep addresses for years, share them with vendors abroad and are not covered by retention schedules. In a breach, they can support re-identification and show who was browsing what.
For the organisation, mapping IP data helps in two ways. It supports lawful security logging, which Rule 6 needs, and it keeps unnecessary copies from piling up. An organisation that is unable to explain why it retains addresses, or that sends them to advertising networks without notice, can face a penalty of up to ₹50 crore for general breaches.
How it works in practice
- 1List every system that records addresses: web servers, load balancers, CDN, WAF, analytics, authentication logs, email and support tools. Add them to your data inventory.
- 2Decide the purpose for each. Security logs, fraud checks and legal retention are clear purposes; ad targeting needs notice and consent.
- 3Shorten or truncate where possible. Many analytics tools allow masking the last octet of an IPv4 address, which keeps approximate location while making individual identification harder.
- 4Set retention periods by purpose: at least what CERT-In directions and Rule 8 require for security logs, and shorter for analytics data.
- 5Give vendors minimum access. If a CDN or analytics provider handles addresses, bind it with a contract covering use, location of storage and deletion.
- 6Handle access requests carefully. If a person asks for their data, you may need to include logs linked to their account, so make sure you can search them.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Saying an IP address is not personal data and ignoring it. When it can be linked to a user, it is personal data and belongs in your notice and retention plan.
Assuming one address equals one person. Shared connections mean that you should not draw firm conclusions about identity from an address alone.
Keeping raw logs forever because disk space is cheap. Retention should follow purpose and legal requirement, not storage cost.
Forgetting third-party scripts. Embedded widgets, fonts and ad tags receive visitors' addresses automatically, so list them in your notice.
Compliance tips
Rotate and archive logs automatically so that expiry does not depend on someone remembering.
Where you use a VPN or proxy for staff, check which logs it creates and who can view them.
Align your retention schedule with CERT-In directions so that you neither delete required logs early nor keep them without need.
Mention IP address collection in your privacy notice in a sentence that a visitor can understand.
Common questions about IP Address
Is an IP address personal data under the DPDP Act?
It is when it can be linked to an identifiable person, for example through an account, subscriber record or device information. A website that logs addresses with logins should treat them as personal data.
Do I need consent to log IP addresses for security?
Security logging is a purpose you can state in your notice, and logs are also expected under Rule 6. You should still be transparent about it. Using the same addresses for advertising needs separate notice and consent.
How long should I keep IP logs?
It depends on purpose and law. CERT-In directions refer to 180 days within India for system logs and Rule 8 refers to a one-year minimum for specified log retention. Keep longer only if the law requires it, and delete marketing-related data sooner.
Can an IP address show my exact location?
Not usually. It generally shows a region or city and an internet provider, and can be wrong when VPNs or mobile networks are involved. Combined with other data it can narrow down location, which is why it still needs care.