Is a name and email address personal data under DPDP?
By dpdprules.org editorial team · Reviewed by dpdprules.org source verificationPublished · Last reviewed
The short answer
Yes. The Act defines personal data as any data about an individual who is identifiable by or in relation to such data. A name identifies a person; an email address identifies and reaches a person; both are data about an identifiable individual. Handled digitally, they are digital personal data, which is what the Act applies to.
Some definitional questions are genuinely hard. This one is not, and it is worth seeing why from the official text itself.
The definition turns on identifiability
"“personal data” means any data about an individual who is identifiable by or in relation to such data"
Three things matter in that sentence. It says any data, without listing categories. It ties the concept to an individual. And it asks one question: is the individual identifiable by the data or in relation to it?
A name is the plainest identifier there is. An email address both identifies a person and provides a way to reach them, and most email addresses contain a name besides. Both are data about an identifiable individual, so both are personal data.
Digital form is what brings the Act in
The Act applies to digital personal data, which is simply personal data in digital form. Names and email addresses in your CRM, sign up database, mailing list, spreadsheet or support inbox are all in digital form. Collected on paper and typed in later also counts, because the application section covers data digitised subsequently.
What follows
If your organisation holds names and email addresses of customers, users, employees or vendors and handles them on computers, you hold digital personal data. That single fact is what makes the applicability question worth settling properly, because everything else in the framework hangs off it.
What to do
Check whether the framework applies to your organisation; the answer traces to the exact definitions quoted above. The full definition list lives at Section 2, official text.
Section 2, official definitions →
Sources cited on this page
- [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(t), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
- [2]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(n), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
- [3]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(h), p. 2. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
- [4]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 3(a), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026The Act covers data collected in digital form or in non digital form and digitised subsequently.