Sensitive personal data: SPDI rules and the DPDP framework
How older SPDI terminology and the DPDP Act should be distinguished in current privacy assessments.
Data>Nuance
Indian businesses may encounter the term sensitive personal data in existing policies and contracts drafted under the SPDI Rules. The DPDP Act uses a different structure and should not be presented as if it contains the same classification terminology.
Why the distinction matters
Legacy documents may still inform contractual and security review, while an implementation programme for the DPDP Act must be mapped to its own requirements and any applicable rules.
Before reusing legacy wording, review the processing purpose, safeguards, notice language and current regulatory basis. Accurate labelling is essential for a credible privacy programme.
This publication is general information and is not legal advice for a specific organisation or matter.