Last reviewed: 26 October 2026. Procedures and timelines change, so confirm on the official sites linked below.
Personal data is any information that can identify you. Sensitive data is the part of it that does the most damage when it leaks. The table below shows the difference, field by field.
The comparison, field by field
| Field | Everyday personal data | Sensitive data named in the 2011 rules | Other high-risk data (not named) |
|---|---|---|---|
| Identity | Name, date of birth, gender, nationality, a profile photo | Not listed separately | Aadhaar, PAN, passport, driving licence and voter ID numbers |
| Contact and login | Email address, mobile number, postal address | Passwords | OTPs, PINs, security questions and answers |
| Money | Employer name, the bank you use, what you bought and when | Bank account details, credit and debit card details, other payment instrument details | Salary and income records, loan and credit-score data, tax returns |
| Health | Gym or yoga class membership | Physical, physiological and mental health condition; medical records and history | Fitness-tracker data that can reveal a condition; disability status |
| Body | An ordinary photograph of your face | Biometric information, such as fingerprints, iris scans, and face or voice templates used to identify you | DNA and genetic data |
| Private life | Language, hobbies, marital status, favourite brands | Sexual orientation | Religion, caste, political views, trade union membership |
| Location and online | City, PIN code, IP address, device model, cookie ID | Not listed separately | Precise live location history, browsing and search history, private messages, call records |
| Family and children | Names of family members you chose to share | Not listed separately | Any data about a child under 18 (the DPDP Act adds extra duties, see below) |
| Work | Job title, office address, work email | Not listed separately | Background-verification results, performance and disciplinary records |
The 2011 list also covers any detail about these categories that you hand to an organisation in order to receive a service. Information that is freely available in the public domain is excluded from that definition.
Three quick questions to classify any field
- Could someone use it to reach your money or accounts? Passwords, OTPs, card numbers and PINs all pass this test.
- Would its exposure reveal something private? Health, sexuality, beliefs, family and precise location are the usual examples.
- Can you change it after a leak? You can reset a password, but you cannot reset a fingerprint, a medical history or your Aadhaar number. The harder it is to change, the more carefully it should be handled.
If the answer to any of these is yes, treat the field as sensitive, whatever the law labels it.
Why the difference still matters
For individuals: share high-risk data only with organisations that explain why they need it, and never in response to an unsolicited call or message. Aadhaar numbers also have their own handling restrictions under the Aadhaar law.
For businesses: the DPDP Act requires reasonable security safeguards for all personal data, and the more harmful a leak would be, the stronger those safeguards should be. Failing to take them carries the highest maximum penalty in the Act, up to ₹250 crore (see Penalties). The volume and sensitivity of the data you hold is also one of the factors the government can use to designate a Significant Data Fiduciary.
For children's data: information about anyone under 18 gets extra protection under the Act whatever its type, including verifiable parental consent and limits on tracking. See Children's Data.
What to do next
If your data has been leaked or misused, see how to report a data breach. If you run a business and want to know which of these fields you hold and how well they are protected, the free DPDP Audit is a good starting point.