Personal Data
Any data about an individual who can be identified by or in relation to that data.
Personal data is any information about a person who can be identified from it, directly or when combined with other information. Names, phone numbers, photos, device IDs and location history can all be personal data.
Meaning of Personal Data
A person is identifiable when the data, alone or together with other information, points to them. Names, phone numbers, email addresses, ID numbers, photographs, device identifiers and location trails can all qualify. The Act has no separate "sensitive" category, so health, financial and biometric data follow the same rules, though they carry higher risk.
Section 2(t) of the DPDP Act defines personal data as any data about an individual who is identifiable by or in relation to such data. Two parts of that wording do the work. The data must be about an individual, and that individual must be identifiable, either from the data itself or in relation to it, meaning with the help of other information the holder has or can reasonably obtain.
The Act gives no list of identifiers, which is intentional. A name and an Aadhaar number are obvious cases. A mobile number, email address, photograph, voice sample, IP address, advertising ID, vehicle registration number or a precise location trail also identify a person in practice. Even a free-text customer comment, such as "the lady in flat 402 asked for a refund", is personal data if the writer can work out who is meant.
Unlike the older SPDI Rules 2011 under Section 43A of the IT Act, the DPDP Act has no "sensitive" sub-category. Health records, bank details and biometrics follow the same rules as an email address. This does not make them equal in risk. A breach of health data is far more damaging, and the Board is told by Section 33(2)(b) to consider the type and nature of the data when fixing a penalty, so sensitivity still shapes outcomes, just not through a separate legal class.
Some personal data sits outside the Act. Section 3(c) excludes data processed by an individual for personal or domestic purposes, and data that the individual made public or that someone made public under a legal obligation. Anonymised data, from which no individual can be identified, is generally not personal data either. Pseudonymised data, where a key still allows re-identification, remains personal data.
Examples of Personal Data
A customer's name and email address in a sign-up form is personal data. Aggregated, properly anonymised sales statistics generally are not.
A shopping site keeps a customer's name, delivery address, order history and a browsing profile tied to a login. All of these are personal data. The site's notice lists each category and the reason it is collected, and the marketing team uses only the categories mentioned.
A lab stores blood-test results under a patient ID, with a separate table linking IDs to names and phone numbers. The results table alone looks anonymous, but because the lab can link IDs to names, the whole set is personal data and is protected as one system.
A company's HR team keeps employee PAN, bank account numbers and attendance logs. These are personal data of employees. The team limits access to payroll staff and deletes data of former employees once the legal [retention period](term/retention-period) ends.
Why Personal Data matters
Personal data is the trigger for almost every obligation in the Act: lawful grounds under Section 4, notice under Section 5, consent under Section 6, security under Section 8(5) and breach intimation under Section 8(6). Misjudging what counts as personal data means missing the duty altogether. The financial exposure is significant, because the Schedule sets maximum penalties of ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to notify a breach.
For individuals, a wide definition means protection reaches the everyday traces they leave online, such as app usage and location pings, not just formal identity documents. For businesses it means a marketing list, a CCTV archive and a cookie profile all need a lawful basis and a retention plan.
How it works in practice
- 1Create a field-level register that lists each personal data element you collect, such as name, mobile number, address, PAN, photograph and device ID, with the purpose and the system where it lives.
- 2Test identifiability carefully: ask whether anyone in the organisation, or a vendor with access, could single out an individual by joining this field with another source.
- 3Collect only what the stated purpose needs. If a delivery needs an address and phone number, do not make date of birth mandatory on the same form.
- 4Apply protective measures that match the risk, including encryption, masking and role-based access under Rule 6, even though the Act does not separate "sensitive" data.
- 5Document where you treat data as anonymised, with the method used and the re-identification risk assessed, so that you can explain the decision to the Board if asked.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing the DPDP Act protects only "sensitive" data. It covers all personal data; plan controls for the whole inventory and add stricter ones for high-risk fields.
Removing the name column and calling the file anonymous. If a mobile number or ID remains, the person is still identifiable, so the data is still personal.
Assuming data that is publicly visible is free to use. Only data made public by the Data Principal or under a legal obligation is excluded, and scraped profiles may not qualify.
Ignoring business contacts. A named person's office email is still personal data.
Compliance tips
Run a quarterly sample check of databases, shared drives and exports to find personal data that nobody listed.
Challenge every mandatory field on forms. If you cannot link it to a stated purpose, make it optional or remove it.
Use pseudonymisation to lower risk, but keep treating the data as personal and protect the re-identification key separately.
Brief your vendors on what you treat as personal data so contracts under Section 8(2) cover the same scope.
Common questions about Personal Data
What counts as personal data under the DPDP Act?
Any data about an individual who is identifiable from it or in relation to it. This includes names, contact details, ID numbers, photographs, biometrics, financial and health details, device identifiers and location data, among many others.
Is there sensitive personal data under the DPDP Act?
No. The Act does not create that category. The older SPDI Rules 2011 did, but health, financial and biometric data now follow the same general rules, with risk and sensitivity influencing penalties and security choices.
Is an IP address personal data?
It can be. If an IP address can be linked to a particular subscriber or user by the organisation or someone it works with, the person is identifiable and the address is personal data. Context decides, so treat it cautiously.
Is the data of a deceased person covered?
The Act speaks of an individual and gives the [right to nominate](term/right-to-nominate) someone to exercise rights on death or incapacity under Section 14. Treat records of deceased persons carefully and follow the nominee's lawful requests.