Virtual Token
A tokenised identifier that stands in for a real identity detail, such as an ID number, without revealing it.
A virtual token is a substitute value that stands in for a real identity detail, such as an ID number, so a service can confirm a fact without seeing or storing the original. Rule 10 mentions it as a way to verify a parent.
Meaning of Virtual Token
Rule 10 allows verification of a parent's identity and age through a virtual token issued by an entity authorised by law or the Government. The token proves the fact without handing the raw document to every service.
A virtual token is a code issued by a trusted provider that maps to a person's real identity or age details but does not reveal them. The receiving service gets enough to confirm a fact, for example that the holder is an adult, while the real number or document stays with the issuer. This is a form of tokenisation, and it is a familiar idea in India from payment card tokens, where a merchant stores a token rather than the card number.
The DPDP Rules use the term in two places. Rule 10, on verifiable consent for children, allows a fiduciary to verify that a parent is an identifiable adult through details the individual provides voluntarily, or through a virtual token mapped to those details, issued by an authorised entity. That entity includes a body entrusted by law or the Government with issuing identity or age details or tokens, and a Digital Locker service provider. Rule 6 on reasonable security safeguards also lists virtual tokens beside encryption and masking as techniques for protecting data.
The token is not the same as encryption. Encrypted data can be restored to its original form by anyone with the key, so the original is still inside the system. A token is meaningless on its own: the link to the real value lives in a separate, protected system at the issuer. If a service that holds only tokens is breached, the attacker gets no usable identity. For that reason, tokens can reduce the impact of an incident.
A token also differs from pseudonymisation in the way the DPDP Act treats data. The Act has no concept of anonymous or pseudonymised data being outside its scope in the way some laws do; if the fiduciary can still link a token back to a person, or can obtain the mapping, the data stays personal data and the duties continue. Tokens help with minimisation and security but are not an exit from the Act.
Examples of Virtual Token
A parent shares a token from a government-backed digital locker that proves she is an adult, without giving the app her full ID document.
A parent opens a verification link, authorises a government-backed locker to share a token and the app receives only a confirmation that the person is an adult. The child's account is then activated, and no ID image is stored.
A lending platform replaces stored PAN numbers in its marketing and analytics databases with tokens. Only the compliance team can request the real value from a locked vault, which cuts the number of people able to see it.
A retailer saves customers' cards for faster checkout as network tokens, not card numbers. A breach of its database yields tokens that cannot be used elsewhere.
Why Virtual Token matters
Tokens matter because breaches are expensive. Failing to keep reasonable security safeguards can lead to a penalty of up to ₹250 crore, and failing to notify a breach up to ₹200 crore. A service whose database contains only tokens has far less to lose in an incident and a simpler story to tell the Board and affected people about what was exposed.
They also help with trust and adoption. Parents are reluctant to upload their ID cards to every app their child wants to use. When a token confirms adulthood without sharing the document, the parent shares less, the app stores less, and the verification step is faster, which improves completion rates for consent flows.
How it works in practice
- 1Identify the data you hold that is sensitive and rarely needed in raw form, such as government ID numbers, card numbers and bank account numbers, and decide where a token could replace the original in everyday systems.
- 2Choose a token provider you can trust, whether an authorised identity service or an in-house vault, and keep the vault in a separate, tightly controlled environment with strong access control and logging as Rule 6 expects.
- 3Design the app so downstream systems such as analytics, support tools and reporting use tokens only. Few staff should ever be able to turn a token back into the original value.
- 4For parental verification, integrate the authorised entity's token flow, check that the response confirms the adult status you need, and store the minimal result, date and the notice version shown.
- 5Test the failure cases: token expiry, revoked tokens, and what happens if the issuer is unavailable, so the user can retry without bypassing the check.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Calling a hashed or lightly scrambled field a token. If a simple method can reverse it, the original is not really protected.
Keeping the token mapping table next to the tokens. If both are in the same system, an attacker who breaks in gets everything.
Believing tokenised data falls outside the Act. If you can re-identify the person, it is still personal data.
Compliance tips
Tokenise as early in the data flow as possible, ideally at collection, so raw values never spread across your systems.
Log every detokenisation request and review the logs; unusual lookups are an early warning of misuse.
Ask your token provider to confirm in writing how mapping data is stored, who can access it and how revocation works.
Common questions about Virtual Token
Is a virtual token the same as encryption?
No. Encryption scrambles data so that anyone with the key can recover the original. A token is a stand-in value with no mathematical link to the original, and the mapping is kept separately by the issuer. Both can support reasonable security safeguards under Rule 6.
Does the DPDP Act require virtual tokens?
No, it does not make them mandatory. Rule 10 allows tokens as one way to verify a parent, and Rule 6 lists them among security measures. A fiduciary may choose other methods that meet the same standard, as long as they are reliable and proportionate.
Does using tokens mean the data is anonymous?
Not necessarily. If the fiduciary or anyone with access can link the token back to a person, it remains personal data covered by the Act. Tokens reduce risk and exposure, but the notice, purpose and retention rules still apply.