Reference
Concepts and glossary
Every important DPDP term, defined in plain English next to the official definition it comes from, with the exact clause cited.
Personal data
Any information about a person who can be identified by it or in relation to it: names, contact details, identifiers, records tied to a person.
Official definition: section 2(t) →
Digital personal data
Personal data on computers, phones or servers, including data collected on paper and digitised later. This is what the Act applies to.
Official definition: section 2(n) →
Data Fiduciary
The organisation that decides why and how personal data is used. Most duties in the framework attach to this role.
Official definition: section 2(i) →
Data Processor
An organisation that handles personal data under another organisation's instructions. Duties reach it mainly through the mandatory contract with the fiduciary.
Official definition: section 2(k) →
Data Principal
The person the data is about. For children, the term includes the parents or lawful guardian; for persons with disability, the lawful guardian acting on their behalf.
Official definition: section 2(j) →
Consent Manager
A Board registered platform through which individuals give, manage, review and withdraw consent. Registration and obligations are set up by Rule 4 and the First Schedule.
Official definition: section 2(g) →
Significant Data Fiduciary
A Data Fiduciary the government names as significant, triggering extra duties: an India based DPO answerable to the company's board of directors, an independent data auditor, and an annual impact assessment and audit cycle.
Official definition: section 2(z) →
Personal data breach
Unauthorised or accidental events that compromise the confidentiality, integrity or availability of personal data. A breach triggers intimation duties to affected people and the Board.
Official definition: section 2(u) →
Processing
Nearly anything done to digital personal data by automated means, from collection and storage through sharing to erasure.
Official definition: section 2(x) →
Child
Anyone under eighteen. Processing a child's data requires verifiable parental consent, and tracking, behavioural monitoring and targeted advertising at children are prohibited, subject to narrow conditional exemptions.
Official definition: section 2(f) →
Data Protection Board of India
The enforcement body: it receives breach intimations and complaints, inquires, and functions as a digital office. Individuals reach it after exhausting the organisation's grievance channel.
Official definition: section 2(c) →
Specified purpose
The purpose named in the notice. Consent is limited to data necessary for it, and its end starts the erasure clock.
Official definition: section 2(za) →