Personal Data under the DPDP Act

Under the Digital Personal Data Protection Act, 2023, personal data is any data about an individual who is identifiable by or in relation to that data. The central test is identifiability, whether information identifies an individual by itself or in relation to other data. The Act regulates the processing of such data in digital form.

Meaning and coverage

Under Section 2(t), personal data concerns an identifiable individual, while Section 2(h) defines data broadly as representations of information, facts, concepts, opinions or instructions suitable for human or automated processing.

• A Data Principal is the individual to whom the personal data relates.
• Under Section 3, the Act covers data collected digitally and non-digital data subsequently digitised, including specified processing outside India connected with offering goods or services in India.
• The Act excludes personal data processed for personal or domestic purposes and data made publicly available by the Data Principal or by a person legally obliged to do so.
• The Act does not separately classify personal data as sensitive or critical.

Lawful processing and State uses

Under Section 4, processing must serve a lawful purpose and rest on consent or a legitimate use. Under Sections 5 and 6, consent must follow or accompany notice and be free, specific, informed, unconditional, unambiguous and evidenced by clear affirmative action.

• Under Section 7, legitimate uses include specified State functions, legal disclosures, compliance with judicial orders, medical emergencies, public-health threats, disasters and employment-related purposes.
• Consent may be withdrawn with ease comparable to that of giving it.

Exemptions for State processing

The Act distinguishes legitimate State uses from exemptions that disapply specified statutory obligations.

• Under Section 17(2)(a), the Central Government may notify a State instrumentality whose processing is exempt in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or prevention of incitement to related cognizable offences.
• The same exemption covers Central Government processing of personal data furnished by such a notified instrumentality.
• Under Section 17(1)(c), processing necessary for preventing, detecting, investigating or prosecuting an offence or legal contravention receives limited exemptions from Chapter II, Chapter III and Section 16; the responsibilities under Section 8(1) and reasonable security safeguards under Section 8(5) continue to apply.