Compare terms

Personal Data vs Digital Personal Data

Personal data is any data about an identifiable individual. Digital personal data is that same data in digital form, and it is the precise subject the DPDP Act regulates.

Why the distinction matters

The DPDP Act's obligations attach specifically to digital personal data. Personal data that exists only on paper sits outside the Act — but the moment it is digitised, it comes into scope. In practice almost everything is digitised, so the regulated set is far wider than “data collected online”.

Getting this wrong usually goes one way: a team assumes offline or paper records are exempt, then scans, uploads or keys them into a system and unknowingly brings them under the Act.

When each applies

Personal data is the broad idea — any data about an identifiable individual, in any form. Digital personal data is the slice the Act regulates. Under Section 3, the Act covers personal data collected in digital form, and personal data collected offline that is later digitised.

Example: a handwritten enrolment form is personal data. Scan it into your CRM and it becomes digital personal data, with notice, consent, security and rights obligations attached.

Common confusions to avoid

“We only keep paper, so we're exempt.” Only until you digitise it. Digitised records are squarely covered.

Treating it like the GDPR term. DPDP deliberately regulates the digital form, so the analysis starts from whether the data is, or becomes, digital.

Assuming anonymised data counts. If data no longer identifies an individual it is not personal data at all — but re-identifiable data still is.

Related glossary terms

Frequently asked questions