Q3 - Can an Indian company freely transfer anonymized data abroad?

Answer

• Yes. Anonymized data, which cannot identify an individual, is not treated as personal data under DPDPA.
• Therefore, its transfer abroad is unrestricted.

Example

• A pharmaceutical company conducting a diabetes study may anonymize patient names, Aadhaar numbers, and phone numbers, retaining only aggregated statistics (e.g., “20% of patients in Maharashtra are diabetic”).
• These anonymized results can be freely shared with research partners in the U.S. or EU.

Weak Controls

However, if the anonymization is weak and individuals can still be re-identified, the Board may treat it as a violation.