SCENARIO M02 · SECURITY & BREACH
A clinic says masking removes all DPDP responsibilities from appointment data. What is the better position?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Assess whether the data remains personal and treat masking as one safeguard, not an automatic exemption.
Document identifiability, access to any mapping key and the other safeguards around the data.
WHY THE OTHER INSTINCTS MISS
Assess whether the data remains personal and treat masking as one safeguard, not an automatic exemption.
Correct. Future Rule 6 lists masking among safeguards; it does not say masking alone ends the framework’s application.
Accept the claim whenever direct names are hidden.
Other attributes or keys may still identify a person in relation to the data.
Avoid masking because it has no legal value.
Masking can be a valuable security measure; the mistake is treating it as the entire analysis.
BUILD THIS EVIDENCE
Identifiability assessment, masking design, key access list and safeguard review.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act ss. 2(t) and 8(5); Rule 6(1)(a); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)