Digital Personal Data
What exactly is data under the Act?
🎯 Learning Objectives
- ▸ Define personal data
- ▸ Understand what makes data "identifiable"
- ▸ Differentiate between personal and non-personal data
The Definition
The DPDPA applies to "digital personal data". This means any data about an individual who is identifiable. This includes obvious things like names and addresses, but also indirect identifiers like IP addresses, cookies, and location data.
Identifiability
What if the data is scrambled? If it's encrypted or pseudonymized but there is a key to unlock it, it is still personal data. Only completely anonymized data (where re-identification is impossible) is excluded.
💡 Example
A dataset with just "User 1234" and their purchase history is still personal data if the company holds a mapping table that links User 1234 to John Doe.
📖 Glossary
- Identifiable
- Able to be identified or recognized from the data, either directly or indirectly.
- Pseudonymization
- Replacing identifying information with a pseudonym, but maintaining a link (key) to the original data.
🔑 Key Takeaways
- If you can identify a person from the data, it is personal data.
- Pseudonymized data may still be personal data.
- Data that cannot identify anyone is excluded.
📚 Further Reading
- DPDPA Section 2(t) — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...