What counts as personal data
Is an email address personal data under DPDP?
- Short answer
- Yes, where it relates to an identifiable individual. firstname.lastname@company.com identifies a person and is personal data. A purely functional address such as info@company.com, which identifies no individual, generally is not.
Personal data under the Act is any data about an individual who is identifiable by or in relation to that data. An email address that names a person meets that easily.
The harder cases are role addresses. sales@ or support@ usually identify a function rather than a person, though if a small firm's contact address is plainly one named individual, the distinction fades.
The safer working assumption for a mailing list is that it is personal data, because the whole point of the list is to reach individuals.
Where this comes from
- Section 2(t), DPDP Act 2023
The mistake people make
Treating work email addresses as business data outside the Act. The address belongs to a person even when the mailbox is paid for by an employer.