Sensitive Data

Sensitive Data Breach 

All confidential information stored and managed by an individual or organization, accessed only to authorized users with permitted access, and clearance to view, shall be categorized under sensitive data. Personal identification information such as name, address, government-issued IDs, financial information, criminal records, and other data used to identify an individual is included in sensitive information. Despite the industry type and size, each organization has legal mechanisms to comply with and secure them. Intellectual property (IP) concerning the creations of humans, and IP rights that protect the rights of creators over their creations also form the framework of sensitive data.

Types of Sensitive Information – Private Data 

  • Personally Identifiable Information (PII) and Personal Information (PI) – PII includes PI, which may or may not be sensitive. Whereas PII like driver’s licenses, social security numbers, alien registration numbers, etc. are always sensitive.


    Personally Identifiable Information (PII) and Personal Information (PI):

    1. Definition: PII is any information that can be used to identify an individual directly or indirectly. PI is a broader term that encompasses PII as well as other information about an individual, even if it’s not directly identifying. 

    Legal Framework: 

    1. Information Technology Act, 2000 (IT Act): Section 43A mandates organizations to protect sensitive personal data. 
    2. Personal Data Protection Bill, 2019 (PDP Bill): The bill, though not yet enacted, provides a comprehensive framework for data protection, including definitions and regulations for PII and PI. 
  • Sensitive Personal Information (SPI) – It consists of all the data which is related to but does not directly resonate to an individual’s identity. Misuse of SPI can lead to harm or damage of sensitive data. Popular examples of SPI include – Account credentials, social security, precise geolocation, etc.


    Sensitive Personal Information (SPI):

    1. Definition: SPI is a subset of PII that is particularly sensitive and could cause significant harm if misused. Examples include financial information, biometric data, health records, sexual orientation, and political opinions. 

    Legal Framework:

    1. IT Act: Section 72A specifically designates certain types of information as sensitive personal data or information and imposes stricter protection measures. 
    2. PDP Bill: The bill includes a more extensive list of SPI and establishes stricter requirements for its processing. 
  • Nonpublic Personal Information (NPI) – This type of sensitive information regulates financial services institutions and was introduced by the Glamm-Leach Bliley Act (GLBA). It includes all bank and account details, court records from a consumer court, etc.

    Nonpublic Personal Information (NPI):

    1. Definition: NPI is financial information about individuals that is not publicly available. It’s primarily regulated by the banking and financial services sector. 

    Legal Framework:

    1. Banking Regulation Act, 1949 (BR Act): Section 45E mandates banks to protect the confidentiality of customer information. 
    2. Reserve Bank of India (RBI) Master Directions on Data Security: Provides detailed guidelines on NPI protection for financial institutions. 
  • Material Nonpublic Information (MNPI) – It holds all data that can impact on a company’s share price. Some of which includes data relating to a company, its holdings, and subsidiaries that haven’t been publicly available to investors in general.

    Material Nonpublic Information (MNPI):

    1. Definition: MNPI is information about a company that is not yet publicly known but could significantly affect its share price if disclosed. It’s primarily regulated in the context of securities markets. 

    Legal Framework:

    1. Securities and Exchange Board of India (SEBI) (Prohibition of Insider Trading) Regulations, 2015: Prohibits insider trading based on MNPI. 
    2. Companies Act, 2013: Mandates directors and officers to maintain confidentiality of company information. 

Sensitive Data Loss – What’s at Stake 

  • Reputation Damage – An organization’s loss of sensitive data is likely to tarnish their reputation in the market, leading to loss of trust among their clients, customers, etc.
  • Financial Losses – Loss of sensitive information can lead to an individual or organization’s financial losses associated with legal fees or intellectual property infringement.
  • Identity Theft– Stealing financial or individual data may lead to theft of personal identity information, fraudulent purchases, bank accounts, etc.
  • Legal and Regulatory Consequences – Breaching data security can open a Pandora’s box of legal trouble, financial penalties, and more, depending on the type of data exposed.
  • National Security Risks – If the information lost is related to government or military operations, then it may induce national security risks.
Views: 14
Related Posts
The Role of IPR Law Firms in Promoting Innovation in Startups
The Role of IPR Law Firms in Promoting Innovation in Startups

As per the definition of intellectual property (IP), it pertains to works of art or literature, industrial designs, brand names, Read more

Cinematic Evolution of Film Financing in India

The Indian film industry has witnessed a remarkable journey over the decades, evolving from a nascent, struggling entity Introduction The Read more

Funding for Startups: Don’t Get Lost in the Fundraising Process

In the era of entrepreneurship. India currently holds the third-largest market share for startups. In fact, the overall amount of Read more

WIPO & Member States Approve the Treaty Relating to IP, Genetic Resources and Associated Traditional Knowledge

As a result of decades of negotiations, Word Intellectual Property Organization (WIPO) member states have approved a groundbreaking treaty relating Read more

Safety and Hygiene Measures 

Coworking spaces have highly transformed the conventional work approach by offering them space, comfort, and flexibility. While maintaining hygiene and Read more

Data Privacy and Security in Indian Fintech: The Expertise of Fintech Law Firm
Digital Healthcare

In recent years, India's fintech sector has seen a dramatic expansion, revolutionized the country's payment system and contributed Introduction In Read more

Arbitration in a New International Alternative Dispute Resolution System
Best lawyers in India - Areness Law

In today's globalized world, disputes arising from international business transactions are becoming increasingly complex. Consequently, the need for expedient and Read more

Regulatory Directive Deals Significant Blow to Paytm’s Growth Prospects
Regulatory Directive Deals

The post-Covid era led to stark changes in every individual’s work-life balance. While adapting to the ‘new normal’, trends like Read more

Ransomware – The Most Dangerous Cyber Threat

Ransomware is a form of malware that locks and encrypts the data, files, devices, or systems of a victim, discarding Read more

Fintech Regulations in India and its Future Outlook
Fintech Regulations in India

In India's ever-changing financial technology (FinTech) platform, both big institutions and new startups must understand the rules they In India's Read more

Need help with legal issues?
Call Back Request