Lesson 2.1: Personal data and digital personal data
Everything in the Act hangs on one definition: personal data. Learn to recognise it instantly. This DPDPA 2023 course page explains personal data and digital personal data in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about personal data and digital personal data
- Define personal data in plain words
- Spot personal data in everyday systems
- Understand what anonymised data means
The identifiability test (personal data and digital personal data)
Personal data is any data about an individual who is identifiable by or in relation to that data. If you can tell who the person is from the data alone or by combining it with other information you hold, treat it as personal data.
Is it personal data? Click each example
Select a numbered box to read more.
Typical personal data held by a small business (personal data and digital personal data)
| Group | Examples | Where it lives |
|---|---|---|
| Customers | Name, phone, address, purchase history | CRM, billing, e-commerce |
| Employees | PAN, bank details, attendance, health claims | HR, payroll |
| Applicants | CVs, interview notes | Email, job portals |
| Website visitors | Cookies, IP, device ID, location | Analytics, ad tools |
| Vendors | Contact persons, bank details | Accounts |
Worked example
A gym stores member name, phone, photo and fingerprint for entry. All four are personal data. Biometrics are not a special category under the Act, but the risk is high, so security must be stronger.
Activity (5 minutes) (personal data and digital personal data)
Pick one system you use. List every field in it and mark each as personal or not.
Check your understanding of personal data and digital personal data
Q1. Which of these is personal data?
Q2. Does the Act create a special sensitive data category?
Q3. Data from which no individual can be identified is generally:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.