What Is Personal Data Under the DPDP Act? Examples for Businesses

Personal data under the DPDP Act is any data about a person who can be identified from it, on its own or together with other information. Digital personal data falls within the Act’s scope subject to its territorial conditions and exclusions. A customer's mobile number counts. So does the appraisal rating HR gave an employee last year, and the work email of the account manager at a logistics vendor.

Personal data appears in lead sheets and call recordings as easily as it does in payroll data and app logs. It is important to first determine what personal data means for your business in order to comply with the DPDP Act, as the result of doing this will shape consent processes and retention policies. The framework has phased commencement dates. Most core business obligations take effect on 13 May 2027. Therefore, there should be enough time to complete a five-step inventory as outlined below.

What Counts as Personal Data? The Legal Definition in Business Terms

Three Definitions Your Legal Team Will Quote

Section 2 of the Act builds the idea of personal data from three linked definitions:

•         Data (Section 2(h)): a representation of information or facts, including opinions and instructions, that people or automated systems can process.

•         Personal data (Section 2(t)): any data about an individual who is identifiable by or in relation to such data.

•         Digital personal data (Section 2(n)): personal data in digital form.

The word "opinions" has practical consequences for sales and credit teams. A note such as "keen on a home loan, follow up in June", typed by a relationship manager against a customer's name, is personal data. The same applies to a credit officer's remark on a loan file. Personal data covers what a team concludes about a person and what the person shared.

The law protects individuals and leaves out companies as entities. A vendor's company name and GSTIN are business information. The finance contact you email at that vendor each month is a person, so her name and number are personal data.

Identifiability: The Test That Decides What Constitutes Personal Information

A record qualifies as personal data if an individual is identifiable by or in relation to it. Some fields do this on their own, such as the name and Aadhaar number. Other fields work in conjunction. A PIN code, date of birth and job title may together identify an individual, depending on the context and other available information.

One of the possible tests that your compliance team can perform is to check whether it is possible for someone in the company to identify the individual associated with the record by using the information available in the company or obtained from other possible sources.

Is PII Data the Same as Personal Data?

In tech and privacy management publications, the term PII (personally identifiable information) is often used in reference to information regarding individuals. The law of India defines personal data and applies one test of identity for all formats. A field that your global policy classes as PII data needs a check against the Act's definition, and a field missing from a PII list can still qualify as personal data under it. Lead scores are one example.

Why Getting the Definition Right Makes DPDP Compliance Easier

Every core DPDP duty attaches to personal data. Notices and consent under Sections 5 and 6 apply to it. Section 8(7) requires erasure following consent withdrawal or when the specified purpose is no longer served, whichever is earlier, subject to legally required retention. Sections 11–14 address access to information about personal data, correction and erasure, grievance redressal, and nomination, subject to their respective conditions.

Through exact mapping, the consent team can determine what forms of data require purpose-specific consent, and the IT team can understand which retention requirements apply to each database. The legal team can link each processing activity to an applicable legal ground within Section 4 - be it consent or a legitimate use from Section 7. Service teams respond faster to a customer's request for information about their personal data, because the systems holding it are already listed.

Examples of Personal Data Under the DPDP Act From Each Department

Personal data circulates within a business. A website lead is transferred to the CRM, retrieved the following morning by the call centre and used by a campaign tool the following week.

Sales and Marketing

• Contact details collected through website forms, WhatsApp campaigns and event sign-ups.

• Additional information added to each contact by marketing automation tools, such as lead scores and segment tags. A lead score records the business’s assessment of an identifiable person.

• Cookie IDs and device IDs that allow the business to identify an individual, including by linking them with other records.

• Loyalty records such as purchase history and points balances.

Recording what a contact has consented to receive helps marketing teams assess whether a proposed campaign falls within that permission.

Customer Service and Operations

• Customer call recordings, chat transcripts and email threads.

• Complaint tickets, delivery addresses and order histories.

• KYC documents, which may include PAN and Aadhaar copies where their collection is permitted under applicable sector requirements.

• Digital CCTV footage from branches and stores where individuals are identifiable.

One loan application may leave copies in the origination platform, document store, collections tool and a shared inbox. Each copy belongs in the data inventory.

Human Resources and Recruitment

• Candidates’ résumés, interview notes and background verification reports.

• Payroll details, bank account numbers and provident fund contribution records.

• Attendance logs, biometric access records and performance ratings.

• Emergency contact and nominee details, which also relate to family members as separate Data Principals.

Employment purposes are among the certain legitimate uses listed in Section 7(i), so routine payroll and attendance processing can rely on that ground. A separate use, such as publishing an employee’s photograph in a newspaper advertisement, requires an assessment of the applicable legal ground and may require consent.

Vendors, Partners and B2B Contacts

• Names, designations and work contact details of supplier and partner representatives.

• PAN and bank details of sole proprietors and individual consultants.

• Digital visitor logs and access badge records for contractors on site.

The Act refers to the individual to whom personal data relates as a Data Principal. The organisation that determines the purpose and means of processing is the Data Fiduciary. Individuals identified in vendor records are therefore also Data Principals, and their information belongs in the organisation’s personal data inventory.

Technology, Product and Analytics

• IP addresses, login histories and application logs linked to identifiable users.

• Location data collected through mobile apps where it relates to an identifiable individual.

• Copies of personal data from production systems held in test environments, backups and analytics warehouses.

• Customer records entered into AI tools, including support chatbots and internal search assistants.

Does the DPDP Act Have a Sensitive Personal Data Category?

No. The DPDP Act does not define a separate category of sensitive personal data. The GDPR and India’s SPDI Rules, 2011, issued under the Information Technology Act, 2000, distinguish certain sensitive categories. Under the DPDP Act, health records and biometric data fall within the general definition of personal data and are subject to its core obligations.

Additional protections and obligations arise through other provisions and sector requirements:

1. Children’s data: Section 9 generally requires verifiable parental consent before processing children’s personal data. It separately prohibits tracking or behavioural monitoring of children and targeted advertising directed at them, subject to applicable statutory exemptions. Parental consent alone does not remove these restrictions.

2. Significant Data Fiduciaries: Under Section 10, the Central Government may notify an organisation or class of organisations as Significant Data Fiduciaries after considering factors including the volume and sensitivity of personal data processed. This designation brings additional obligations.

3. Payment and banking data: Applicable RBI requirements continue to govern payment and banking data alongside the DPDP framework.

Many Indian privacy policies continue to use SPDI categories because they were drafted under the earlier framework. Section 44(2) of the DPDP Act provides for the omission of Section 43A from the IT Act. Reviewing privacy policies and data classifications ahead of that change helps keep company documents aligned with the applicable law.

What Data Falls Outside the Scope of the DPDP Act?

The Act’s scope depends on how personal data is collected and processed, with specific exclusions for certain uses and sources. Understanding these distinctions helps teams determine where DPDP obligations apply.

Paper Records That Remain on Paper

A handwritten visitor register in a branch drawer will not be covered by the Act. Section 3 covers processing of personal data collected on paper and subsequently digitised, subject to the Act’s territorial conditions and exclusions. If your company operates a branch network or field sales force, DPDP obligations can apply when paper records are digitised, including through scanning.

Personal or Domestic Use

An individual’s processing of a family photo album for personal or domestic purposes is excluded under Section 3(c)(i). Processing customer telephone numbers for work does not qualify for the personal or domestic exemption; ownership of the phone or records does not determine applicability.

Publicly Available Personal Data

Personal data that the individual made public, or that someone had a legal duty to publish, is excluded by Section 3(c)(ii). The Act's own illustration describes a woman who shares her personal data on social media while blogging her views.

Data that reached the internet through a leak, or through a third party with no legal duty to publish, stays inside the Act. Legal commentators have raised open questions about large-scale uses such as AI training. For teams that buy or scrape contact lists, a sensible default is to treat them as personal data until legal confirms who published the information and on what basis.

Anonymised Data and Company Information

Aggregated data, such as monthly sales by region, falls outside the definition of personal data only where individuals are no longer identifiable. The pseudonymized data remains in scope: If a company replaces customer names with customer numbers and retains the key to remap them, it continues to have personal data.

Section 17 includes both partial exemptions and an exemption from the Act for processing necessary for research, archiving or statistical purposes, provided it is not used for decisions specific to a Data Principal and meets the prescribed standards. The use of one should be confirmed with your legal team before it's relied upon by the business.

How to Identify Personal Data Across Your Organisation: A Five-Step Inventory

This five-step method offers a tool for identifying personal data throughout your organisation. An inventory may begin with a shared spreadsheet and a brief meeting with department heads:

1. List the systems. Ask each team which applications it uses, from the CRM to the HRMS. Add       shared drives, backups and test environments, since copies collect there.

2. Record the fields. For each system, note which fields relate to individuals. Free-text notes, call recordings and attachments deserve a line of their own.

3. Write down the purpose. Next to each field, record why the business collects it, in plain words such as "loan servicing" or "payroll". Legal will use these purposes to assign a ground under Section 4.

4. Follow the data. Trace where each data set travels, including vendors and cloud providers. Each recipient affects your vendor contracts and breach response plan.

5. Name an owner. Give each system an owner and a quarterly review date, so the inventory keeps pace with new products and campaigns.

Each row of the finished inventory then records:

•         The system and the field

•         Whose data it is, such as a customer or candidate

•         The purpose and the ground under Section 4

•         The owner and the review date

•         The retention period, once legal has set it

With the inventory in place, notices and consent journeys have a reference point, and so do retention schedules.

Related reading: Data Retention Policies Under DPDPA: How Long Can You Hold Personal Data

From Personal Data Map to Live Consent Records With OneConsent

An inventory shows where personal data lives; the ongoing work is applying consent and erasure rules as customers sign up, buy and call in.

OneConsent is a DPDPA consent management platform designed for that routine work. Your teams are able to capture purpose level consent via your websites, apps and assisted channels (branches, call centre, etc). Each consent record is then stored for audit purposes. Should a customer wish to revoke their consent, OneConsent will send this information through to your connected systems (CRM, campaign tools, etc), so they stop using this customer's data for that particular purpose.

Requests for access, correction and erasure are routed through tracked workflows, helping teams monitor requests and manage responses. OneConsent can help bring records from older customer databases onto DPDP-ready consent governance. Teams considering DPDPA compliance software in India should note that OneConsent’s compliance page lists ISO 27001, ISO 27701, SOC 2 Type II and PCI DSS 4.0 credentials for Easyrewardz Software Services Pvt. Ltd.

Personal Data Mapping and Consent Programme Roll-Out

Personal data subject to the scope of the DPDP Act is not confined to the customer database, but also may include candidates, employees and contact persons with vendors. If you are mapping personal information before May 2027, the OneConsent team will accompany you on your customer and employee journeys, highlighting where consent should be collected, and how withdrawals and rights requests should be processed in the systems you already have in place. Customers can work through a demo of the OneConsent platform here and can arrange a demo to investigate how it fits with their own data.