What counts as personal data
Is anonymised data covered by DPDP?
- Short answer
- No, if it is genuinely anonymised, because the individual is no longer identifiable and the data is no longer personal data. The difficulty is that much of what is called anonymised is only pseudonymised, and pseudonymised data remains in scope.
Removing a name is rarely enough. If a key, a device identifier or a combination of fields still allows you or anyone else to single out the individual, the data remains personal data.
This matters for retention, because erasure by anonymising is a legitimate approach: data that can no longer identify anyone by any means reasonably likely to be used has effectively been erased.
It also matters for analytics, where teams often believe a dataset is anonymous because the analyst does not know the names, while the join key back to identity still exists elsewhere in the business.
Where this comes from
- Section 2(t) and Section 8(7), DPDP Act 2023
The mistake people make
Calling data anonymised when a re identification key still exists somewhere in the organisation.