The DPDP Act does not create a separate category called 'sensitive personal data' (as the older IT Rules did). All personal data is protected, and the same core obligations apply. However, the Central Government can notify Data Fiduciaries as Significant Data Fiduciaries partly based on the sensitivity of the data they handle, which brings extra duties.