Sensitive Personal Data
A category of more protected data under the older IT Act rules, such as health, financial and biometric data. The DPDP Act has no such category.
Sensitive personal data is a category of extra-protected information, such as health, financial and biometric data, that existed under the old SPDI Rules. The DPDP Act does not have this category.
Meaning of Sensitive Personal Data
Under the SPDI Rules, categories like passwords, financial information, health records, sexual orientation and biometrics needed written consent. The DPDP Act treats all personal data under the same rules, though regulators and the Board will expect stronger safeguards for riskier data.
Under Rule 3 of the SPDI Rules, 2011, sensitive personal data or information meant a defined list: passwords; financial information such as bank account, credit card or debit card details; physical, physiological and mental health condition; sexual orientation; medical records and history; and biometric information, together with related details supplied to a body corporate for providing a service. Information freely available in the public domain, or furnished under the Right to Information Act, was excluded. For these categories the old Rules required written consent and a stated purpose.
The DPDP Act takes a different route. It does not carve out a special class. Every item of digital personal data is regulated under the same set of duties: notice, valid consent or a legitimate use, security safeguards, breach intimation, retention limits and the rights of access, correction and erasure. A person's taste in music and her HIV status sit under the same legal grammar. The Act's protection therefore reaches far more data than the SPDI list, such as names, contact details, location and browsing history, which were largely outside the older Rules.
That does not mean all data is treated identically in practice. The Act builds risk in through other doors. Section 10 allows the Central Government to notify Significant Data Fiduciaries after considering, among other things, the volume and sensitivity of the personal data processed, and those fiduciaries carry additional duties. Section 9 gives children a distinct protection regime. Rule 6 expects security safeguards to be reasonable for the data at stake, so a hospital or a lender is expected to do more than a blog with a newsletter list.
Other regulators continue to treat some data as special. The RBI has rules on payment data, IRDAI on policyholder information, the NMC and clinical establishment norms on patient records, and the Aadhaar Act on Aadhaar numbers. Section 38 keeps these in place. If you work in healthcare, finance or HR, you should expect sector regulators to be your source of "sensitive" treatment, with the DPDP Act as the common baseline.
Examples of Sensitive Personal Data
A hospital that treated "sensitive" data separately under the old rules now applies consent, notice and security duties to all patient data.
A hospital applied tight controls to diagnosis records but left appointment lists in shared spreadsheets. After moving to DPDP thinking, it applies [access control](term/access-control) and logging to both, since a leaked appointment list also reveals who is a patient.
A fintech app restricted access to card numbers under the old regime but treated device identifiers and location as ordinary. It now includes them in its notice, retention schedule and breach plan.
An HR team handled medical certificates carefully and shared salary data casually. It limits salary and attendance data to payroll staff, keeps it under the employment-related use in Section 7(i), and erases it as the retention schedule requires.
Why Sensitive Personal Data matters
Teams that built programmes around the sensitive list often applied strong controls only to health and financial fields and light-touch controls to everything else. Under the DPDP Act that approach leaves exposure: a data leak of names and phone numbers can still be a personal data breach that must be reported to the Board and to each affected person, and the penalty for failing to maintain reasonable security can reach ₹250 crore regardless of the data type.
For individuals, the change means wider legal protection. Even ordinary-looking data like location history or purchase patterns can now be subject to notice, consent, correction and erasure rights, although the law relies on proportionate safeguards, not categories, to decide how much protection is enough.
How it works in practice
- 1Retire the category-based consent logic. Build one consent and notice framework for all personal data, with purpose-specific wording that explains why each type of data is needed.
- 2Run a risk-based classification internally anyway. Label data by harm if leaked (for example, health, financial, children's, location, credentials) and apply stronger encryption, masking, access control and logging to higher-risk classes, as Rule 6 encourages.
- 3Check sector rules for the data you hold. List the regulator's localisation, retention and disclosure requirements so they sit beside your DPDP plan.
- 4Re-examine data minimisation. Stop collecting fields that were previously avoided because they were "sensitive" but are now freely gathered, such as precise location, and justify each against the stated purpose.
- 5Train staff to treat all personal data as protected, and to use the same breach-reporting channel for any incident, whatever the data type.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Searching the DPDP Act for a "sensitive" list. There is none. Applying the old list to decide what to protect leaves gaps.
Assuming less risk for non-sensitive fields. Names, mobile numbers and addresses are fully covered and their leak is a reportable breach.
Dropping extra care for health and finance. Rule 6 safeguards must be reasonable, and sector regulators still treat these categories strictly.
Using SPDI consent forms unchanged. They do not meet the notice and consent standards of the DPDP Act.
Compliance tips
Use an internal risk tier for data even though the law has no formal tier. It guides spending and incident priority.
Document why each category of data is needed, so you can justify it if the Board asks.
Review vendor access to your higher-risk data and tighten contract clauses.
Revisit the position whenever the Government issues new Rules, as the Rules could add specific treatment for particular classes of data.
Common questions about Sensitive Personal Data
Does the DPDP Act have sensitive personal data?
No. The Act uses the single term personal data and applies the same obligations to all of it. The sensitive-data list came from the SPDI Rules, 2011 under Section 43A of the IT Act, which the DPDP Act omits.
Is health data protected under the DPDP Act?
Yes, as personal data, with notice, consent or a legitimate use, security safeguards and breach reporting. There is no separate health-data chapter, but sector rules such as medical-council norms continue to apply under Section 38.
Do I still need written consent for financial data?
The SPDI requirement of written consent will no longer be the standard once the DPDP obligations commence. Consent under Section 6 must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, which can be given electronically.
Can the Government treat some data as more sensitive later?
The Act allows the Government to notify Significant Data Fiduciaries, considering factors including the sensitivity of data, and the Rules may set particular standards. Sector regulators can also impose stricter rules. Watch for notifications.