Personal Data under the DPDP Act

Under the Digital Personal Data Protection Act, 2023, personal data is any data about an individual who is identifiable by or in relation to that data. The central test is identifiability, whether information identifies an individual by itself or in relation to other data. The Act regulates the processing of such data in digital form.

Meaning and coverage

Under Section 2(t), personal data concerns an identifiable individual, while Section 2(h) defines data broadly as representations of information, facts, concepts, opinions or instructions suitable for human or automated processing.

• A Data Principal is the individual to whom the personal data relates.
• Under Section 3, the Act applies to data collected digitally and non-digital data subsequently digitised. It also covers specified processing outside India connected with offering goods or services in India.
• It excludes personal data processed for personal or domestic purposes and data made publicly available by the Data Principal or by a person legally obliged to do so.
• The Act does not separately classify personal data as sensitive or critical.

Basis for lawful processing

Under Section 4, processing must serve a lawful purpose and rest on consent or a legitimate use. Under Sections 5 and 6, consent must follow or accompany notice and be free, specific, informed, unconditional, unambiguous and evidenced by clear affirmative action.

• Under Section 7, legitimate uses include specified State functions, legal disclosures, compliance with judicial orders, medical emergencies, public-health threats, disasters and employment-related purposes.
• Consent may be withdrawn with ease comparable to that of giving it.

Exemptions for State processing

Under Section 17(2)(a), the Central Government may notify an instrumentality of the State whose processing is exempt from the Act in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order, or preventing incitement to related cognizable offences.

• The exemption also covers Central Government processing of personal data furnished by the notified State instrumentality.
• Under Section 17(1)(c), processing necessary for preventing, detecting, investigating or prosecuting an offence or legal contravention receives limited exemptions from Chapter II, Chapter III and Section 16.
• Even under the limited offence-related exemption, the responsibility under Section 8(1) and reasonable security safeguards under Section 8(5) continue to apply.