What counts as personal data
Is Aadhaar personal data under DPDP?
- Short answer
- Yes. An Aadhaar number identifies an individual directly, so it is personal data. It is also governed separately by the Aadhaar Act, which restricts who may collect it and for what, so both sets of rules apply at once.
The DPDP Act does not create a separate category of sensitive personal data, so Aadhaar is not formally in a higher tier. That does not make it ordinary in practice.
The Aadhaar Act and its regulations independently limit collection, storage and authentication. Many organisations collect Aadhaar copies as a general identity proof when they have no legal basis to hold the number at all.
Where you do hold it, the expectation is strong access control, encryption or masking, and a real retention limit. Collecting it out of habit is the most common failure.
Where this comes from
- Section 2(t) and Section 8(5), DPDP Act 2023
- Rule 6, DPDP Rules 2025
The mistake people make
Collecting and storing Aadhaar copies as a default KYC step without checking whether you are permitted to hold the number.