Data Protection

Non-Personal Data

Data not relating to identified or identifiable individuals.

How the laws define this

Every cited framework establishes that non-personal data consists of datasets that do not relate to or permit the identification of an identified or identifiable natural person, including appropriately anonymised, aggregated, or de-identified data that falls outside personal data protections such as the GDPR. The instruments diverge on how they operationalize governance and facilitate reuse. The Draft National Data Governance Framework Policy focuses on dataset eligibility for the India Datasets programme and sharing via metadata or APIs, whereas the Report by the Committee of Experts on Non-Personal Data Governance Framework emphasizes re-identification risks and harmonised anonymisation standards. Meanwhile, the Regulation of Artificial Intelligence and Non-Personal Data Bill coordinates rules with the EU Data Act, the Data Strategy of the Federal Government highlights contractual and technical building blocks for secondary use, and the MeitY report distinguishes non-personal data from synthetic data to establish tailored licensing and access controls.

Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Ireland	Regulation of Artificial Intelligence Act 2026	In Force	Sets rules for use, sharing and re-use of such data, coordinating with EU Data Act and national data-governance arrangements.
India	Report of the Committee on Platforms and Data on Artificial Intelligence (MeitY report)	Adopted	Specifies aggregated or de-identified datasets not permitting re-identification under standard tests, treated differently for access, licensing and governance.
Germany	Data Strategy of the Federal Government	Adopted	Signals need for legal frameworks and contractual/technical building blocks to govern secondary use and sharing.
India	Draft National Data Governance Framework Policy / India Data Accessibility and Use Policy (drafts)	Draft	Treats such data as eligible for discovery and reuse subject to other restrictions, guiding inclusion in India Datasets programme or sharing under metadata/APIs.
India	Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee)	Under Review	Proposes harmonised anonymisation standards to classify datasets reliably, bounded by identifiability and re-identification risk.

What it triggers

In Ireland under the Regulation of Artificial Intelligence Act 2026, it sets rules for use, sharing and re-use.source

Definitions (5)

Data that does not relate to an identified or identifiable natural person (including appropriately anonymised datasets); the Bill sets rules for its use, sharing and re-use, and coordinates those rules with the EU Data Act and national data-governance arrangements.

Regulation of Artificial Intelligence and Non-Personal Data Bill (heads of bill / preparation stage)Definition 1 of 5

Datasets that are aggregated or de‑identified such that they do not permit re‑identification of individuals under standard tests; treated differently from personal data for access, licensing and governance purposes. The Committee distinguishes non‑personal data from personal and synthetic data to enable differentiated access controls and reuse conditions.

Report of the Committee on Platforms and Data on Artificial Intelligence (MeitY report)Definition 2 of 5

Datasets that, in their stored or released form, do not permit the identification of any natural person and therefore fall outside personal data protections; the draft treats such data as eligible for discovery and reuse subject to other restrictions. The classification guides whether datasets can be included in the India Datasets programme or shared under metadata/APIs.

Draft National Data Governance Framework Policy / India Data Accessibility and Use Policy (drafts)Definition 3 of 5

Data that cannot be attributed to an identifiable natural person and therefore falls outside the scope of the GDPR (including appropriately anonymised datasets). The Strategy distinguishes non-personal data from personal data and signals the need for legal frameworks and contractual/technical building blocks to govern its secondary use and sharing.

Data Strategy of the Federal Government ('Datenstrategie der Bundesregierung')Definition 4 of 5

Non-Personal Data (NPD) means data that is not related to an identified or identifiable natural person, including personal data that has been anonymised; the regime is bounded by identifiability and re-identification risk, and the Report proposes harmonised anonymisation standards to classify datasets reliably.

Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee)Definition 5 of 5

Not to be confused with

Personal Data

Personal data relates to an identified or identifiable person, while non-personal data does not.

Anonymisation

Anonymisation is the process rendering data no longer identifiable, whereas non-personal data is the resulting data that cannot identify individuals.

Questions and answers

What rules apply to non-personal data in Ireland?

The Regulation of Artificial Intelligence Act 2026 sets rules for its use, sharing and re-use. It coordinates those rules with the EU Data Act and national data-governance arrangements.

How does India distinguish non-personal data for governance?

India's reports treat non-personal data differently from personal and synthetic data to enable differentiated access controls and reuse conditions. It is aggregated or de-identified to prevent re-identification.

What governance does the Gopalakrishnan Committee propose for non-personal data?

The Report proposes a comprehensive governance model bounded by identifiability and re-identification risk. It recommends harmonised anonymisation standards for reliable classification.