Location Data
Information about where a person or device is, from GPS, mobile networks, Wi-Fi or IP addresses.
Location data tells where a person or their device is or has been, taken from GPS, mobile towers, Wi-Fi, Bluetooth or even an IP address. A trail of locations reveals where someone lives, works and prays.
Meaning of Location Data
Location trails reveal homes, workplaces and habits, so they are high-risk personal data. Collect location only when needed, say so in the notice, and avoid keeping long histories.
Location data comes in several forms. Precise location comes from GPS or Wi-Fi positioning, down to a few metres. Coarse location may be city-level from a mobile network or an IP address. Derived location comes from geotagged photographs, delivery addresses, check-ins and payments at particular shops. Each can be personal data under Section 2 when it relates to an identifiable person, or to a device that can be linked to one.
The DPDP Act gives location no special status. It needs a lawful ground: consent under Section 6, or a legitimate use under Section 7. The notice under Section 5 and Rule 3 should explain what kind of location is collected, whether in the background or only while the app is open, for what purpose, and how to withdraw consent. Consent must be specific; one "allow location" permission at install does not cover profiling or sale to advertisers that the person never heard of.
Single points are less revealing than patterns. One timestamped location at a restaurant says little, but a month of data identifies a home, an office, a clinic and a place of worship. This is why long retention is hard to justify. Section 8(7) requires erasure once the purpose is served, and Rule 8 treats traffic and logs data separately, with a minimum one-year log retention for specified purposes.
Children get stronger protection. Section 9 bars tracking and behavioural monitoring of children and targeted advertising directed at them, with exemptions defined in the Rules, so a parental-safety app that follows a minor's movements needs careful analysis and verifiable parental consent. Telecom licence obligations on location data continue alongside the DPDP Act through Section 38.
Examples of Location Data
A ride app uses location during the trip and stops collecting when the trip ends.
A ride app collects precise location during a trip and for two minutes before pickup. After the trip it keeps only the start and end areas for billing disputes, and deletes the full route after 30 days.
A retail chain wants to push offers when shoppers are near a store. It asks separately for location permission, explains the purpose, and ensures that declining has no effect on the shopper's loyalty points or discounts.
A logistics employer tracks delivery vans through a vehicle GPS. It limits tracking to working hours, tells drivers what is recorded, and does not track personal phones after shifts end.
Why Location Data matters
Misuse of location data can cause physical harm: stalking, harassment, burglary when people are away, or exposure of someone visiting a clinic or shelter. For the business, a location leak is a safety story as well as a compliance one.
Collecting location without valid consent or retaining it beyond need can lead to a penalty of up to ₹50 crore as a general breach, and security failures up to ₹250 crore. Apps that quietly collect background location for ad targeting are the most likely to attract complaints, and platform stores increasingly reject them.
How it works in practice
- 1Decide what precision you need. A weather app wants the city, a taxi needs the pickup point, a delivery rider needs live location only while an order is active. Ask for the least precise setting that works.
- 2Ask at the point of need. Show the permission prompt when the user taps "find nearby stores", with one sentence on why, rather than at first launch.
- 3Separate foreground from background. If background collection is essential, say so in the notice and provide a visible indicator and an easy off switch.
- 4Cut retention. Convert raw coordinates into coarse areas after the trip or delivery, and delete the original trail on a short schedule you can state in the notice.
- 5Restrict internal access. Support staff should see a trip only when handling a complaint on that trip, with access logged.
- 6Check sharing. If partners such as map providers or analytics tools receive location, list them in the notice and contract for no secondary use.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating an operating-system permission as the whole of your consent. The permission is a technical switch; your notice must still state purposes and withdrawal route.
Collecting precise location when city-level would do. Over-collection increases the damage of a leak.
Keeping years of trip history for analytics. Aggregate or anonymise early and delete the raw trail.
Tracking employees or children without explaining it. Surveillance of minors faces the Section 9 bar, and staff tracking needs a clear and limited purpose.
Compliance tips
Test your app with location permission denied and confirm it still works for features that do not need it.
Review SDKs in your app, because many third-party libraries collect location without the product team noticing.
Publish a short location policy explaining precision, frequency and retention in plain terms.
Include location data in the breach register, since a leak of live positions is a safety issue that needs a rapid response.
Common questions about Location Data
Is location data personal data under the DPDP Act?
Yes, when it relates to an identifiable person or to a device linked to one. The Act has no special tag, but location trails are high-risk, so notice, specific consent, short retention and firm security are expected.
Can an app track my location in the background?
Only if it has a lawful ground, normally your informed consent, and tells you clearly in its notice. You can withdraw consent as easily as you gave it under Section 6. Background tracking of children is barred by Section 9.
Can my employer track my phone?
An employer needs a lawful ground and a clear purpose. Section 7(i) covers certain employment purposes, but tracking outside work hours or on a personal phone is hard to justify. Employers should explain what is tracked and limit it to work needs.
Does an IP address count as location data?
An IP address gives approximate location, such as the city, and is personal data when linked to a person. It is less precise than GPS, but combined with other data it can still reveal where someone lives or works.