Glossary
What is personal data under DPDP?
Personal data is any data about an identifiable individual. The DPDP Act treats it as one category, with no separate sensitive class.
Definition
Under s.2 of the DPDP Act, 2023, personal data is any data about an individual who is identifiable by or in relation to such data. The Act applies to digital personal data (s.3). It has no separate category of “sensitive personal data”; that idea comes from the SPDI Rules, 2011 under the IT Act.
What it means
The test is identifiability: is the data about an individual who can be identified by it or in relation to it? Common Indian identifiers such as a name, mobile number, PAN or Aadhaar number usually qualify.
The Act does not grade personal data into sensitive and non-sensitive classes. The type of data still matters: the Board considers it when deciding a penalty (s.33(2)), and sensitivity is a factor for notifying Significant Data Fiduciaries (s.10).
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines personal data and digital personal data |
| s.3 | Applies to digital personal data processed in India, and to processing outside India connected with offering goods or services in India |
| s.3 | Excludes personal or domestic purposes, and data made publicly available by the Data Principal or under a legal obligation |
| s.10 | Sensitivity of data is a factor for SDF notification |
| s.33(2) | Type of personal data is a factor in penalties |
Common misconceptions
- “DPDP has a sensitive personal data category.” It does not. The SPDI Rules did, and that regime continues until s.44(2) of the Act commences (DPDP vs SPDI).
- “Anything found online is outside the Act.” s.3 excludes data made publicly available by the Data Principal or under a legal obligation, not all data that can be found.
- “All paper files are covered.” The Act covers digital personal data: collected digitally, or collected otherwise and digitised (s.3).
Related terms
Personal data in digital form, the Act's scope (s.2, s.3).
ProcessingAny wholly or partly automated operation on digital personal data (s.2).
Data PrincipalThe individual the personal data relates to (s.2).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
In TruePrivacy
Classification uses 59 detection rules, including India-specific ones for Aadhaar number, PAN, GSTIN, UPI ID, Indian mobile numbers, voter ID (EPIC) and ABHA number. Samples are masked by the scanner before they leave the source, and data discovery shows where each kind of personal data sits.
Does the DPDP Act define sensitive personal data?
No. The Act has a single category of personal data. “Sensitive personal data” comes from the SPDI Rules, 2011, which continue until s.44(2) of the Act commences.
Is an Aadhaar or PAN number personal data?
Yes. Each identifies an individual, so it is personal data under s.2. The DPDP Act does not put them in a separate category.
Does DPDP apply to publicly available personal data?
Not to personal data made publicly available by the Data Principal, or by someone under a legal obligation to publish it (s.3). Other data found in public is not excluded on that ground alone, so check with counsel before relying on it.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin