Big picture
Data about people can help schools, hospitals and governments make better decisions, but it can also expose private lives, enable fraud, or treat people unfairly. Responsible data practice means collecting, storing, analysing and sharing data in ways that are lawful, fair, secure and honest.
As someone who handles data in Pandas, SQL and projects, you need to know what counts as personal data, how to protect it, how bias creeps into data and decisions, and how to present results without misleading people.
Learning goals
Distinguish personal data and sensitive personal data.
Apply consent, purpose limitation and data minimisation.
Explain anonymisation and pseudonymisation.
Explain data quality and how bias enters data and algorithms.
Explain data security measures.
Present data honestly and avoid misleading charts.
Explain open data, licences and India's data protection law.
Core ideas
1. Personal and sensitive data
Type | Meaning | Examples |
|---|---|---|
Personal data | Any data that identifies or can identify a person | Name, address, phone number, email, photo, roll number, IP address |
Sensitive personal data | Personal data that can cause serious harm if misused | Health records, financial details, passwords, biometric data (fingerprints), Aadhaar number, religion, caste |
Even data that seems harmless can identify someone when combined: age + PIN code + school could point to one student.
2. Principles of responsible data collection
Principle | Meaning | Example |
|---|---|---|
Informed consent | People must know what data is collected, why, and how it will be used, and must agree freely | A survey states its purpose and lets students opt out |
Purpose limitation | Use data only for the purpose stated when it was collected | Marks collected for a project shouldn't be used to send advertisements |
Data minimisation | Collect only the data that is actually needed | A marks survey doesn't need phone numbers or home addresses |
Storage limitation | Keep data only as long as needed, then delete it securely | Delete raw survey data after the project is assessed |
Accuracy | Keep data correct and up to date | Let people correct wrong entries |
Accountability | The data collector is responsible for protecting the data |
3. Anonymisation and pseudonymisation
Anonymisation removes or changes identifying information so that people can't be identified at all, for example replacing names with nothing and reporting only class-level averages.
Pseudonymisation replaces identifiers with codes (Student 1, Student 2), while the key linking codes to names is kept separately and securely. It reduces risk but is reversible by whoever holds the key.
Aggregation reports summaries (averages, counts) instead of individual records.
Example: a table of individual marks with names is personal data. The same table with names replaced by S01, S02 … is pseudonymised. A table showing only "Section 12A average = 169.33" is aggregated and far safer.
4. Data quality
Good decisions need good data. Data quality problems include:
Missing values (blank fields);
Duplicates (the same record entered twice);
Inconsistent formats (dates written in different ways, "Delhi" and "New Delhi");
Errors and outliers (a mark of 900 out of 100);
Outdated data.
Cleaning (checking, correcting, removing and documenting) is part of responsible practice, because poor data leads to wrong conclusions.
5. Bias in data and algorithms
Bias is a systematic error that makes data or results unfair or unrepresentative.
Source of bias | Example |
|---|---|
Sampling bias | A survey on student screen time asks only students who stay back after school, missing others |
Historical bias | A hiring model trained on past data, where one group was rarely hired, learns to prefer the other group |
Measurement bias | A faulty sensor records higher temperatures in one city |
Confirmation bias | An analyst looks only for data that supports what they already believe |
Reducing bias: collect data from a representative sample; check results across different groups; be transparent about methods and limitations; and keep humans involved in important decisions made with algorithms.
6. Data security
Measure | Purpose |
|---|---|
Access control | Only authorised people can view or change data (user accounts, permissions) |
Strong passwords and two-factor authentication | Prevent unauthorised logins |
Encryption | Converts data into an unreadable form that only those with the key can read; protects data stored on devices and sent over networks (HTTPS) |
Backups | Copies of data protect against loss from hardware failure or ransomware |
Updates and antivirus | Fix security weaknesses and detect malware |
Secure deletion | Properly erasing data when it is no longer needed |
A data breach is an incident where data is accessed, leaked or stolen without authorisation; responsible organisations must act quickly and inform those affected.
7. Honest reporting and visualisation
Charts can mislead even when the numbers are correct.
Truncated y-axis: starting the axis at 90 instead of 0 makes a small difference (92 versus 95) look huge. Start bar charts at zero.
Cherry-picking: showing only the years that support a conclusion.
Wrong chart type: using a pie chart for data that doesn't add up to a whole.
Missing context: showing totals instead of rates (more accidents in a big city may simply reflect its larger population).
Always label axes and units, state the data source, and mention limitations.
8. Open data and licences
Open data is data made freely available for anyone to use, such as government datasets on data.gov.in. When using open data, follow its licence (for example, give attribution) and cite the source. Data scraped from websites may be protected by copyright or terms of use.
9. Law: the Digital Personal Data Protection Act, 2023
India's DPDP Act, 2023 governs the processing of digital personal data. Key ideas:
A data principal is the person the data is about; a data fiduciary is the organisation that decides how and why data is processed.
Personal data may be processed for a lawful purpose, generally with the person's consent, which must be free, specific, informed and clear.
Data principals have rights to access information about their data, to correction and erasure, and to grievance redressal.
Data fiduciaries must protect data with reasonable security safeguards and inform the Data Protection Board and affected persons of breaches.
Processing children's data needs verifiable parental consent.
A reliable approach to questions
Identify whether data is personal or sensitive, and what harm misuse could cause.
Check the collection against consent, purpose limitation and minimisation.
Suggest anonymisation, pseudonymisation or aggregation before sharing.
Look for sources of bias in how data was collected or used.
Check charts for truncated axes, cherry-picking and missing context.
Connections that matter
Societal impacts covers digital footprints, IPR and cyber crime.
Data communication project applies these principles to your own data.
Data visualisation explains how to draw honest charts.
Common mistakes
Assuming that removing names alone always makes data anonymous. Combinations of other fields can still identify people.
Collecting extra data "just in case". This violates data minimisation.
Starting bar chart axes far above zero and exaggerating differences.
Treating algorithms as automatically fair. They can reproduce bias in their training data.
Revision checklist
I can distinguish personal and sensitive personal data.
I can explain consent, purpose limitation, minimisation and storage limitation.
I can explain anonymisation, pseudonymisation and aggregation.
I can identify data quality problems and sources of bias.
I can explain data security measures.
I can spot misleading charts.
I can explain the main features of the DPDP Act, 2023.