s.2 · s.3
Personal data
Under the DPDP Act, personal data is any data about an individual who can be identified by that data or in relation to it.
The definition is wide on purpose. A name or a phone number identifies someone on its own; an IP address, a device id or a customer number identifies someone in relation to other data the business holds. All of it is personal data.
The Act applies to personal data in digital form, and to data collected on paper and digitised afterwards. A visitor form, a chat transcript, a CCTV export once stored, an analytics cookie: each is digital personal data the moment it exists on a system.
There is no separate category of sensitive personal data in the Act. The older SPDI Rules of 2011 had one; the DPDP Act replaced that approach with one standard for all personal data, and stronger rules only for children and for Significant Data Fiduciaries.
Questions people ask
- Is a business email address personal data?
- Yes. It identifies an individual, and the Act does not exclude data about people acting in a professional capacity.
- Is an IP address personal data?
- Yes, in relation to other data such as a timestamp and a page visited. That is why a script that sends the IP address to a third party before consent is a Section 6 problem.
- Does the Act cover paper records?
- Only once they are digitised. A paper form in a cabinet is outside it; the same form scanned or typed into a system is inside it.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.