Section 8(5) · Rule 6
Classify Indian personal data for DPDP
Indian personal data has its own shapes: Aadhaar numbers, PANs, UPI IDs, names in Devanagari. TruePrivacy's classification is built to recognise them.
Sample workspace
Data classes
- Aadhaar number3 stores · 41,200 records
- PAN5 stores · 88,900 records
- ABHA number1 store · 2,310 records
- UPI ID2 stores · 19,450 records
- Indian mobile number9 stores · 1.2 lakh records
Latest finding
- Sample •••• •••• 4821 masked at source
- AI suggested: Aadhaar number
- Confirm or reject
Short answer
The DPDP Act requires reasonable security safeguards (s.8(5)), and Rule 6 lists measures such as masking, access control and logging. You can only apply them to data you know you hold. TruePrivacy classifies personal data with 59 detection rules, including India-specific ones for Aadhaar, PAN, GSTIN, UPI ID and ABHA, masks samples before they leave the source, and has a person confirm each AI suggestion.
What classification detects
Personal data is any data about an individual who is identifiable by or in relation to it. In India that often means identifiers such as Aadhaar, PAN and UPI IDs, so detection needs rules for Indian formats.
Aadhaar number and Aadhaar Virtual ID, PAN, GSTIN, IFSC, UPI ID, Indian mobile numbers, passport, voter ID (EPIC), driving licence and vehicle registration.
EPF and UAN numbers, ABHA number and ABHA address.
PIN codes and addresses, and names, including names written in Devanagari.
The scanner masks samples before they leave the source.
Each kind of personal data found, most sensitive first, with where it sits, record counts, high-risk stores, first found and last seen.
AI suggests a classification; a person confirms or rejects it.
How a finding becomes a data class
- 01Scan a source
Connect a database, storage bucket or SaaS tool through integrations and run a scan.
- 02Review suggestions
AI suggests a classification for each finding, with a masked sample. Confirm or reject it.
- 03Read the data classes
See each class, most sensitive first, with the stores that hold it and their record counts.
- 04Act on high-risk stores
Tighten access, mask or erase where needed, and track the work in data security posture.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Reasonable security safeguards | s.8(5) | Shows which stores hold which kinds of personal data, so safeguards cover them |
| Encryption, obfuscation, masking or virtual tokens | Rule 6 | Samples masked by the scanner before they leave the source |
| Access control and visibility of access | Rule 6 | High-risk stores listed per data class, ready for access review |
| Summary of personal data on request | s.11 | Data classes show what kinds of personal data you hold and where |
| Erase when the purpose is no longer served | s.8(7) | Retention rules per data category |
What classification does not decide
The DPDP Act does not define 'sensitive personal data', so the order in data classes is a working order for your team, not a legal category. Like any pattern detection, it can miss values or flag the wrong field. That is why a person confirms or rejects each suggestion.
The SPDI Rules under the IT Act did define sensitive personal data, and they continue until s.44(2) of the DPDP Act commences. See DPDP vs the IT Act SPDI Rules and check the commencement notification G.S.R. 843(E).
Works with
Which Indian identifiers does TruePrivacy detect?
Aadhaar number and Virtual ID, PAN, GSTIN, IFSC, UPI ID, Indian mobile numbers, passport, voter ID (EPIC), driving licence, vehicle registration, EPF and UAN numbers, ABHA number and address, PIN codes, addresses and names, including Devanagari names. These are among 59 detection rules.
Does DPDP define sensitive personal data?
No. The DPDP Act does not define it; the SPDI Rules under the IT Act did. Treat any sensitivity ranking as a working order, not a DPDP category.
Do reviewers see raw values?
No. Samples are masked by the scanner before they leave the source.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin