Profiling
Using data to evaluate or predict things about a person, such as interests, behaviour or creditworthiness.
Profiling means using someone's data to build a picture of them, such as what they like, how they behave or how likely they are to repay a loan, and then acting on that picture.
Meaning of Profiling
The DPDP Act does not define profiling or give a separate right against it. But profiling needs a lawful ground and a notice, targeted advertising and behavioural monitoring of children are barred, and decisions based on inaccurate profiles raise accuracy duties.
The DPDP Act does not define profiling, and it has no standalone right to object to it, unlike the GDPR, where Article 4(4) defines it and Articles 21 and 22 give individuals specific rights. That does not make profiling a free zone. Profiling is one way of processing personal data, so every general duty applies: a lawful ground under Section 4, a notice under Section 5 that tells the person what is being done and why, and, where consent is the ground, consent under Section 6 that is specific to the purpose and limited to the data necessary for it.
The first practical consequence is about purpose. A customer who gave her phone number to receive a delivery update has not agreed to be scored for ad targeting. If you want to build a behavioural profile, say so in the itemised notice that Rule 3 requires, in plain language, and obtain consent for that purpose separately from the core service. Under Section 6, consent cannot be bundled so that the user must accept profiling to use the service when profiling is not needed for it.
The second consequence concerns children. Section 9(3) bars a Data Fiduciary from tracking or behavioural monitoring of children, and from targeted advertising directed at them. Profiling that rests on such monitoring is therefore off-limits for anyone under 18, subject to any exemptions the Rules provide in the Fourth Schedule for specified purposes. Platforms with mixed audiences need age-gating that actually works, because a profile built on a child's clicks is a violation even if the company never intended it.
The third consequence is accuracy. Section 8(3) requires a fiduciary to make reasonable efforts to ensure that data used to make a decision affecting a Data Principal is complete, accurate and consistent. A profile is only as good as its inputs, so stale or wrongly merged records are a compliance issue, not just a data quality one. Significant Data Fiduciaries add another layer: under Rule 13 they must exercise due diligence that algorithmic software they use does not pose a risk to Data Principals' rights. Profiling differs from the neighbouring ideas of targeted advertising (one use of a profile) and automated decision-making (acting on a profile without human review).
Examples of Profiling
A shop builds a profile of a customer's interests from her purchases, and uses it to send tailored offers with her consent.
A retailer groups customers into "bargain hunters" and "premium buyers" based on purchase history. It asks for separate opt-in consent to personalised offers, and customers who decline still receive their orders and receipts normally.
A lender scores applicants using repayment history and bank statements shared with their consent. Because the score drives a decision about the applicant, the lender checks the data is accurate and complete and lets the applicant ask for a correction before the decision is final.
An education app for teenagers wants to recommend ads based on browsing behaviour. Since its users are children, it turns off behavioural tracking and targeted ads, and uses only contextual, non-tracking suggestions within the app.
Why Profiling matters
Profiling is where an ordinary service quietly becomes a data-intensive business, and it is where regulators and customers get uncomfortable. A weakly explained profile can attract complaints to the Board and a penalty of up to ₹50 crore for general breaches of the Act, and up to ₹200 crore if it involves children's data in breach of Section 9. The reputational cost of being seen to track users covertly can be larger than the fine.
For individuals, profiling can narrow what they are offered, from credit limits to insurance premiums to the jobs they see. Knowing that the law requires a clear notice, a purpose-specific consent and the right to withdraw consent as easily as it was given helps people keep some control over a process that is otherwise invisible.
How it works in practice
- 1Inventory every place you build or use profiles: marketing segmentation, credit scoring, recommendation engines, fraud scoring, staff performance dashboards. Note the inputs, the outputs and who sees them.
- 2For each profile, identify the lawful ground. If it relies on consent, write a separate consent request that explains the profiling in plain words, and make withdrawal one click. Do not treat the Section 7 legitimate uses as a catch-all, since the Act has no general legitimate-interest ground.
- 3Update the Rule 3 notice so it names the categories of data used for profiling, the purpose and the person's routes to withdraw consent and to complain to the Board.
- 4Block profiling features for users identified as children until verifiable parental consent is in place, and switch off tracking, behavioural monitoring and targeted advertising for them altogether.
- 5Test profiles for accuracy and bias, correct errors promptly when a Data Principal asks under Section 12, and delete profile data when the purpose ends or consent is withdrawn under Section 8(7).
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming profiling is outside the Act because it is not defined. It is processing of personal data, so notice, consent, security and erasure duties apply.
Hiding profiling in a long [privacy policy](term/privacy-policy). Rule 3 expects an itemised, plain-language notice. A line buried in legal text will not support valid consent.
Profiling children's behaviour for engagement. Section 9(3) prohibits tracking and behavioural monitoring of children, whatever the commercial rationale.
Never refreshing profiles. Old scores keep affecting people. Section 8(3) and the erasure duty both require you to correct or retire stale data.
Compliance tips
Describe each profile in one sentence a customer would understand. If you cannot, the notice will not be understood either.
Separate analytics that use aggregated, de-identified data from profiling that targets individuals. The first carries lower risk.
Document a retention period for each profile and erase it on schedule.
Give a Data Principal who asks under Section 11 a clear answer on what categories of data you hold and with whom they are shared.
Common questions about Profiling
Is profiling allowed under the DPDP Act?
Yes, if you have a lawful ground, usually consent, give a clear notice and meet the security and accuracy duties. The Act does not ban it generally, except that tracking, behavioural monitoring and targeted advertising directed at children are prohibited under Section 9(3).
Does the DPDP Act give a right to object to profiling like GDPR?
Not as a separate right. The Act gives rights of access, correction and erasure, grievance redressal and nomination. However, a person who consented to profiling can withdraw consent at any time, and the fiduciary must then stop processing for that purpose.
Can I profile employees under the DPDP Act?
Section 7(i) permits processing for employment purposes without consent, but it is limited to what employment needs. Using staff data for something unrelated, such as selling insights to outsiders, falls outside it and needs another ground.
Is profiling the same as targeted advertising?
No. Profiling is building a picture of a person. Targeted advertising is one use of that picture. Profiling can serve other aims, such as fraud detection or credit assessment, and each aim needs its own lawful ground.