What counts as personal data under DPDP?
Personal data explained simply: what kinds of information count under India DPDP Act, what may be more sensitive, and why the definition is broad.
The simple answer
Under the DPDP Act, personal data is broadly any data about an individual who can be identified by or in relation to that data. That is wider than many people expect.
It can include your name, phone number, email, address and account details, and also things that combine to identify you. The breadth is the point: a lot of everyday data is personal data.
What to check
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
More is personal data than you think.
State of Privacy examines the full range of signals companies collect because personal data is broad, and even an "anonymous" visit can become identifiable.
What to do next
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
People also ask
Is my phone number personal data?
Yes. Identifiers like your phone number generally count as personal data because they can identify you.
Does anonymous data count?
If data can be linked back to identify you, it can fall within personal data even if it looks anonymous.
What is sensitive personal data?
Categories like health and finance are widely treated as more sensitive and deserve extra care, depending on how the law applies.
How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.
Talk to Meridian Bridge Strategy →Your personal data belongs to you. You can ask a company what it holds and how to raise a privacy request. The response depends on the applicable duties, identity checks and any retention requirements.
Get the template email →The public report shows what we found in the company records. Check the observation dates and method.