The DPDP Act has no formal 'sensitive data' tier — but you still can't protect everything equally. A simple data-classification scheme lets you apply stronger controls where the risk is higher, which is exactly what 'reasonable' security expects.
Why classify
Classification drives proportionate security, retention and access — and makes rights and breach response faster because you know what's where.
A simple scheme
- Public — no personal data; low controls.
- Internal — basic personal data (names, emails).
- Confidential — identity, financial, location, behavioural.
- Highly sensitive — health, biometric, children's, financial credentials.
Apply controls by class
Map each class to encryption, access, retention and logging requirements. Highly sensitive data gets the strictest handling.
Tie it to your data map
Classify as part of your data map, and keep it current as systems change.
A classification checklist
- Adopt 3–4 clear classes
- Classify each data store in your map
- Define controls per class
- Review as data and systems change
How DPDP Bridge helps
DPDP Bridge helps you classify data as part of mapping, and apply the right security and retention controls to each class. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.