Personal data

Section 2(t) of the Digital Personal Data Protection Act, 2023 defines personal data as any data about an individual who is identifiable by or in relation to such data. 'Data' under Section 2(h) means a representation of information, facts, concepts, opinions or instructions suitable for communication, interpretation or processing by humans or automated means, and digital personal data under Section 2(n) is personal data in digital form. The test is identifiability: data about a natural person who can be identified from it, alone or in relation to it. Data about a company, or data that does not identify an individual, is not personal data.

The Act turns on related definitions. The Data Principal is the individual to whom the personal data relates and, for a child (a person under eighteen under Section 2(f)), includes the parents or lawful guardian, and for a person with disability, the lawful guardian acting on her behalf (Section 2(j)). The Data Fiduciary is any person who alone or with others determines the purpose and means of processing (Section 2(i)). A personal data breach is unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability (Section 2(u)).

Under Section 3, the Act applies to digital personal data processed in India, whether collected digitally or digitised later, and to processing outside India connected with offering goods or services to Data Principals in India. It does not apply to personal data processed by an individual for a personal or domestic purpose, or to data made publicly available by the Data Principal or under a legal obligation; the illustration of a blogger who posts her own data on social media makes the point. Under Section 4, personal data may be processed only for a lawful purpose with consent or for certain legitimate uses.

The Act also provides, by Section 44(2), for the omission of Section 43A of the Information Technology Act, 2000, which dealt with compensation for failure to protect sensitive personal data; aspirants should check the commencement notification for which provisions are in force. Examiners test the identifiability test, the meaning of Data Principal for children and the exclusions in Section 3.