Is a GSTIN personal data under the DPDPA?
The answer is not a simple yes or no. It depends critically on who the GSTIN belongs to, a corporate entity or a natural individual
Understanding GSTIN: Structure and Public Disclosure
GSTIN is a unique 15-digit alphanumeric identifier assigned by the Government of India to every taxpayer registered under the Goods and Services Tax (GST) regime. Its structure is not arbitrary – digits 3 to 12 embed the PAN (Permanent Account Number) of the registered taxpayer, digits 1 and 2 represent the state code, digit 13 indicates the number of registrations under that PAN in that state, and digits 14 and 15 are system-generated check characters.
Critically, the GST portal (gst.gov.in) is a publicly accessible platform. Any person can search for a GSTIN and retrieve the legal name of the taxpayer, the trade name, the state of registration, the type of business constitution (proprietorship, partnership, private limited company, etc.), and the registration status. Herein, public disclosure is not incidental – it is mandated by law to ensure tax transparency and facilitate B2B compliance verification.
The DPDPA Definition of Personal Data
Section 2(t) of the DPDPA defines personal data as: “any data about an individual who is identifiable by or in relation to such data.” Three elements stand out in this definition:
- “Individual” – The DPDPA protects only natural persons. Legal entities such as companies, LLPs, and registered partnerships are outside its scope. The Act uses the term “Data Principal” to refer exclusively to the natural person whose data is being processed.
- “Identifiable” – The standard is identifiability, not direct identification. If data, alone or in combination with other data, can lead back to a specific natural person, it qualifies as personal data. View is broadly similar to the identifiability standard under the EU’s GDPR.
- “By or in relation to” – This is an expansive formulation. Data does not need to name a person explicitly; it merely needs to relate to someone who can be identified through it.
Case 1: GSTIN of a Company, LLP, or Partnership (Non-Personal Data)
When a GSTIN is issued to an incorporated entity – a Private Limited Company, a Public Company, an LLP, or a registered Partnership – the data points disclosed on the GST portal relate to the legal entity, not to any natural person.
A company is a juristic person in law, but it is not a “natural individual.” DPDPA explicitly limits the definition of Data Principal to natural persons. Therefore, the GSTIN of a company, the company’s registered name, its address, and its registration status – none of these constitute personal data under the DPDPA.
Processing such GSTINs for business verification, invoice validation, Input Tax Credit (ITC) reconciliation, or supplier due diligence does not attract DPDPA obligations. The claim that GSTIN issued to organisations and disclosed to the public is non-personal data is correct.
Case 2: GSTIN of a Proprietorship or Individual (Personal Data)
When we talk about GSTIN of Proprietorship or Individual, the analysis turns fundamentally different. A sole proprietorship has no separate legal existence from its owner. In law, the proprietor and the business are one and the same person. When a GSTIN is issued to a proprietorship, the “legal name” registered under GST is typically the owner’s own name. The embedded PAN (digits 3–12 of the GSTIN) is the individual’s personal PAN. The address disclosed may be the individual’s home or personal business address. Searching such a GSTIN on the GST portal publicly reveals:
- Proprietor’s full legal name
- Their PAN (embedded within the GSTIN structure)
- State and city of business
- Registration date and current status
Each of these data points relates to an identifiable natural individual. Under Section 2(t) of the DPDPA, this squarely constitutes personal data. Therefore, it is safe to assume that GSTIN associated with proprietors or individuals is personal data is correct.
The Critical Nuance: The Publicly Available Data Exception
Here is the layer of analysis that is most frequently overlooked, and it matters enormously for compliance. DPDPA does not apply to all personal data without exception, the act carves out an explicit exemption: its provisions do not apply to personal data that has been made publicly available by a person who is under a legal obligation to make it so.
GSTN (GST Network) and the GST portal publish taxpayer data pursuant to statutory obligations under the CGST Act, 2017. And it raises important question: does the public availability of a proprietor’s GSTIN data on the GST portal take it outside the scope of DPDPA protection entirely?
The answer requires careful reasoning across three scenarios:
- Scenario A – Government publishing GSTIN data on the portal: The act of the GST portal making this data publicly accessible is itself covered by the public availability exemption. The government is under a legal obligation to maintain and disclose GST registration data. This specific act of disclosure does not attract DPDPA liability.
- Scenario B – A business verifying a supplier’s GSTIN for invoice compliance: This is a routine, legally mandated activity. The ITC framework under the CGST Act effectively requires businesses to verify GSTINs. Such verification, being purpose-limited and legally grounded, does not constitute processing of personal data in a manner that triggers DPDPA obligations.
- Scenario C – A private entity aggregating, storing, or processing proprietor GSTINs for commercial purposes (credit scoring, profiling, targeted marketing, data brokerage): This scenario steps entirely outside the public availability exemption. The exemption covers the act of making data public by the legally obligated authority – it does not grant a blanket license for any third party to then harvest, aggregate, or commercially exploit that data. A fintech company building a credit risk model using proprietor GSTINs, or a data broker selling enriched GST datasets, would be processing personal data and must comply with DPDPA obligations including lawful basis, purpose limitation, data minimization, and security safeguards.
Practical Compliance Implications
For organizations that handle GSTIN data in their systems, the following principles apply:
- Vendor and supplier onboarding systems that collect GSTINs from proprietors should recognise that this constitutes collection of personal data. A lawful basis under the DPDPA must exist – typically, it will be a contractual necessity or a legal obligation.
- KYC and onboarding platforms (especially in fintech, insurance, and e-commerce) must not treat publicly available GSTIN data as free from all data protection obligations simply because it appears on the GST portal. Herein, the obligation shifts based on the purpose and nature of processing.
The Correct Position Under DPDPA
A GSTIN may not be considered personal data for companies, but it can become personal data when linked to proprietors or individuals under the DPDPA. Also, just because GST information is publicly available does not mean businesses can freely use it for commercial or analytical purposes without obligations. The key questions are simple: who does the GSTIN belong to, and why are you processing it? The answers determine whether DPDPA requirements apply.
