The concept of Data & Information is not a standalone Act or scheme, but a fundamental concept defined within key Indian legislation, primarily the Information Technology Act, 2000 (IT Act, 2000) and the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023). The formal legal recognition of these terms began with the IT Act, 2000, which was enacted on June 9, 2000, and enforced on October 17, 2000, to provide legal recognition to electronic communications and transactions, solving the problem of validating digital records in a paper-based legal system.
The IT Act, 2000 establishes a clear hierarchy: "data" is defined in Section 2(1)(o) as a representation of information, knowledge, facts, concepts, or instructions prepared in a formalised manner and intended to be processed in a computer system or network. In this context, 'information' is the raw content (like texts, images, audio, or video), and 'data' is the structured, formalised representation of that information ready for computer processing.
The concept has changed significantly with the enactment of the DPDP Act, 2023, which received the President's assent on August 11, 2023, following the Supreme Court's recognition of the right to privacy as a fundamental right in 2017. The new Act connects the concept directly to the individual's rights. Section 2(h) of the DPDP Act defines "data" more broadly as a representation of information, facts, concepts, opinions, or instructions suitable for communication or processing by human beings or automated means. The critical addition is "personal data" in Section 2(t), which is any data about an individual who is identifiable by or in relation to such data. This shift moves the focus from the technical definition of data to the protection of the individual, known as the Data Principal, whose rights include the right to correction, completion, updating, and erasure of their personal data. The DPDP Act, 2023, replaced the earlier framework of the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, which functioned under the IT Act, 2000.