What is Personal Data?
A practical guide to understanding the foundation of the Digital Personal Data Protection Act, 2023 — in plain, simple English.
Personal Data is the Foundation of the DPDP Act
The Digital Personal Data Protection Act, 2023 is built entirely around the concept of personal data. Before an organization can comply with the Act — or before any rights or obligations under it apply — the first question is: “Is the information we are handling personal data?”
🔍 Identify
Recognize what qualifies as personal data in your organization.
🛡️ Protect
Apply the right safeguards once personal data is identified.
⚖️ Comply
Meet your legal obligations under the DPDP Act, 2023.
What Does the DPDP Act Mean by “Personal Data”?
The Act defines Personal Data as:
In plain English: if a piece of information — alone or together with other information — can point to a specific, real person, it is personal data. The individual does not need to be directly named. It is enough that they can be identified from the data.
What Does “Identifiable” Mean?
An individual is identifiable when information can be used directly or indirectly to single out that person from others. It does not require their name.
Direct Identification
“Rahul Sharma, residing at 12 MG Road, Bengaluru” — the name and address together directly identify one specific person.
Indirect Identification
“The 45-year-old male diabetic patient in Ward 3, Bed 7” — no name is given, but only one person fits this description in context.
Combination Identification
A PIN code, employer name, and job title may not identify someone alone, but together they can narrow it down to one individual.
The broad definition under Section 2(t) can include information that identifies an individual directly, indirectly, or through a combination of data.
Common Types of Personal Data
The following are clear examples of personal data under the DPDP Act, 2023. Each can identify a specific individual alone or in combination.
Identity
- Full Name
- Photograph
- Date of Birth
Contact
- Mobile Number
- Email Address
- Residential Address
Government IDs
- Aadhaar Number
- PAN
- Passport / Driving Licence
Health & Biometric
- Health Records
- Medical Reports
- Biometric Information
Financial
- Bank Account Details
- Salary Information
Digital & Location
- GPS Location
- IP Address
- CCTV Images
Real-World Examples by Sector
Personal data exists in every industry. Here is how it looks in practice across five major sectors.
🏥 Healthcare
Patient registration, prescriptions, laboratory reports, diagnosis history, and treatment records.
🏦 Banking
KYC documents, account numbers, transaction history, and loan applications.
👥 HR
Employee records, attendance logs, payroll data, and performance appraisals.
🎓 Education
Admission forms, examination results, fee receipts, and student contact details.
🛒 E-Commerce
Delivery address, order history, saved payment methods, and browsing behavior.
Can This Information Identify an Individual?
Use this decision framework whenever you are unsure whether a piece of information qualifies as personal data under the DPDP Act.
1. Look at the data
Does it contain a name, contact detail, ID, image, location, or another personal attribute?
2. Consider the context
Could the information single out a person when combined with other information available to your organization?
3. Apply the rule
If a specific individual can be identified directly or indirectly, treat it as personal data.
Not All Information is Personal Data
The Act applies only where an individual is identifiable. The following types of information are generally not personal data:
📊 Anonymous Statistics
Aggregate numbers with no link to any specific person, such as “5,000 patients treated this month.”
📈 Company Financials
Total revenue, company turnover, and department budgets refer to the organization, not an individual.
🌦️ General Reports
Weather reports, market summaries, and inventory figures that cannot be traced to a person.
🏭 Operational Data
Machine output logs, warehouse stock levels, or process metrics with no individual identifier attached.
Personal Data vs. Not Personal Data
| ✅ Personal Data | ❌ Not Personal Data |
|---|---|
| Employee Name, such as “Priya Mehta” | Total Employees in the Organization |
| Individual Patient’s Medical Report | Total Patients Treated This Month |
| Customer’s Email Address | Monthly Sales Report — Aggregated |
| Individual Employee’s Salary | Company’s Total Revenue |
| GPS Location of a Specific User | City-Wide Traffic Statistics |
| IP Address Linked to an Individual | Anonymized Website Traffic Count |
Common Misconceptions About Personal Data
Myth: All digital data is personal data
Reality: Digital format alone does not make data personal. Weather readings or anonymous sales totals are not personal data unless they identify an individual.
Myth: Business information is personal data
Reality: Data about a company—its revenue, operations, or products—is not personal data. The Act protects individuals, not legal entities.
Myth: Anonymous data is the same as personal data
Reality: Truly anonymized data, where re-identification is not possible, falls outside the Act. If re-identification is possible, it remains personal data.
Identifying Personal Data is Step One of Any Privacy Program
You cannot protect what you have not identified. Before an organization can implement policies, appoint a Data Protection Officer, obtain consent, or respond to a Data Principal’s rights request, it must first know what personal data it holds and where.
1. Map Your Data
Identify personal data collected, stored, and processed across systems and departments.
2. Classify It
Determine which data is personal, sensitive, or outside the Act’s scope.
3. Apply Safeguards
Implement technical and organizational measures to protect personal data.
4. Stay Compliant
Fulfill obligations under the DPDP Act, 2023 with confidence and accountability.
What You Should Remember
1. Personal data identifies an individual
This includes direct identifiers such as name and Aadhaar and indirect identifiers such as IP address or CCTV footage in context.
2. A combination can qualify
Context matters. Data that seems harmless alone may become personal data when combined with other information.
3. Not everything is personal data
Anonymous statistics, aggregated reports, and company-level information generally fall outside the DPDP Act’s scope.
4. Identification starts compliance
Mapping and classifying personal data is the first critical step for a privacy program.
What is Digital Personal Data?
In the next module, we explore how the DPDP Act applies specifically to digital personal data, how offline data enters the Act’s scope when digitized, and what this means for day-to-day operations.
DPDP Act 2023 Series · Module 2 → DPDP #05 - What is Digital Personal Data?
Disclaimer
This presentation is intended solely for educational and professional awareness purposes. It provides a general overview of the subject matter discussed. While every effort has been made to ensure the accuracy of the content, it should be read with applicable laws, rules, regulations, official guidance, and judicial developments.