DPDP Act glossary
Every term defined in section 2 of the Digital Personal Data Protection Act, 2023, quoted verbatim, with a short plain-English note on the ones that decide real questions. Plus the terms people look for that the Act does not use.
Appellate Tribunal · Automated · Board · Certain legitimate uses · Chairperson · Child · Consent Manager · Data · Data Fiduciary · Data Principal · Data Processor · Data Protection Impact Assessment (DPIA) · Data Protection Officer · Digital office · Digital personal data · Eighth Schedule languages · Gain · Legitimate interests · Loss · Member · Notification · Person · Personal data · Personal data breach · Prescribed · Proceeding · Processing · Sensitive personal data · She · Significant Data Fiduciary · Specified purpose · State · Third Schedule (retention) · Verifiable parental consent
Appellate Tribunal
TDSAT. Appeals from Board orders lie within 60 days (s.29).
"Appellate Tribunal" means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997)
s.2(a), DPDP Act 2023, verbatim. Read section 2.
Automated
"automated" means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data
s.2(b), DPDP Act 2023, verbatim. Read section 2.
Board
The Data Protection Board of India, an adjudicatory body. It has no rule-making power; the Central Government makes the Rules (s.40).
"Board" means the Data Protection Board of India established by the Central Government under section 18
s.2(c), DPDP Act 2023, verbatim. Read section 2.
Certain legitimate uses
The closed list of non-consent grounds in s.7. There is no legitimate interests ground.
"certain legitimate uses" means the uses referred to in section 7
s.2(d), DPDP Act 2023, verbatim. Read section 2.
Chairperson
"Chairperson" means the Chairperson of the Board
s.2(e), DPDP Act 2023, verbatim. Read section 2.
Child
Anyone under 18. Not 13 or 16 as in other regimes. Tracking, behavioural monitoring and targeted advertising directed at children are banned outright (s.9(3)).
"child" means an individual who has not completed the age of eighteen years
s.2(f), DPDP Act 2023, verbatim. Read section 2.
Consent Manager
A Board-registered platform through which people give, manage, review and withdraw consent. Accountable to the Data Principal, not the business. Registration under Rule 4 commences 14 November 2026.
"Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform
s.2(g), DPDP Act 2023, verbatim. Read section 2.
Data
"data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means
s.2(h), DPDP Act 2023, verbatim. Read section 2.
Data Fiduciary
The business or body that decides why and how personal data is processed. Closest GDPR analogue: controller. The test is conjunctive, purpose and means (s.2(i)).
"Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
s.2(i), DPDP Act 2023, verbatim. Read section 2.
Data Principal
The individual the data is about. Closest GDPR analogue: data subject. For a child it includes the parent or lawful guardian (s.2(j)).
"Data Principal" means the individual to whom the personal data relates and where such individual is— (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf
s.2(j), DPDP Act 2023, verbatim. Read section 2.
Data Processor
Processes personal data on a Data Fiduciary's behalf. Must be engaged under a valid contract (s.8(2)).
"Data Processor" means any person who processes personal data on behalf of a Data Fiduciary
s.2(k), DPDP Act 2023, verbatim. Read section 2.
Data Protection Impact Assessment (DPIA)
A periodic assessment that Significant Data Fiduciaries must carry out. The Act defines it as a description of Data Principal rights and the purpose of processing, plus the assessment and management of risk to those rights (s.10(2)(c)(i)). Rule 13(1) requires a DPIA and audit every twelve months.
Data Protection Officer
Required only for notified Significant Data Fiduciaries, and must be based in India and responsible to the board of directors (s.10(2)(a)).
"Data Protection Officer" means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10
s.2(l), DPDP Act 2023, verbatim. Read section 2.
Digital office
"digital office" means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode
s.2(m), DPDP Act 2023, verbatim. Read section 2.
Digital personal data
The Act only applies to personal data in digital form, or collected on paper and digitised later (s.3(a)).
"digital personal data" means personal data in digital form
s.2(n), DPDP Act 2023, verbatim. Read section 2.
Eighth Schedule languages
Gain
"gain" means— (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration
s.2(o), DPDP Act 2023, verbatim. Read section 2.
Legitimate interests
Loss
"loss" means— (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration
s.2(p), DPDP Act 2023, verbatim. Read section 2.
Member
"Member" means a Member of the Board and includes the Chairperson
s.2(q), DPDP Act 2023, verbatim. Read section 2.
Notification
"notification" means a notification published in the Official Gazette and the expressions "notify" and "notified" shall be construed accordingly
s.2(r), DPDP Act 2023, verbatim. Read section 2.
Person
"person" includes— (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub-clauses
s.2(s), DPDP Act 2023, verbatim. Read section 2.
Personal data
Very wide: any data about an identifiable individual. The Act creates no separate sensitive-data category.
"personal data" means any data about an individual who is identifiable by or in relation to such data
s.2(t), DPDP Act 2023, verbatim. Read section 2.
Personal data breach
Includes mere loss of access, so ransomware counts. Every breach is notifiable to the Board and each affected individual, with no harm threshold (s.8(6)).
"personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data
s.2(u), DPDP Act 2023, verbatim. Read section 2.
Prescribed
"prescribed" means prescribed by rules made under this Act
s.2(v), DPDP Act 2023, verbatim. Read section 2.
Proceeding
"proceeding" means any action taken by the Board under the provisions of this Act
s.2(w), DPDP Act 2023, verbatim. Read section 2.
Processing
Wholly or partly automated operations on digital personal data, from collection to erasure.
"processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction
s.2(x), DPDP Act 2023, verbatim. Read section 2.
Sensitive personal data
Not a DPDP concept. The Act has no special category: health, biometric, financial and caste data get no extra tier, though sectoral law may still add duties. The old SPDI Rules 2011 category rested on IT Act s.43A, which s.44(2)(a) omitted.
She
Gender-neutral. The Act uses 'she' for every individual.
"she" in relation to an individual includes the reference to such individual irrespective of gender
s.2(y), DPDP Act 2023, verbatim. Read section 2.
Significant Data Fiduciary
Exists only once the Central Government notifies an entity or class under s.10(1). Size alone does not make you one, and none had been notified as at the last check. Only SDFs must appoint a DPO.
"Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10
s.2(z), DPDP Act 2023, verbatim. Read section 2.
Specified purpose
"specified purpose" means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder
s.2(za), DPDP Act 2023, verbatim. Read section 2.
State
The State as defined in Article 12 of the Constitution, which brings government bodies within the Act subject to the s.17 exemptions.
"State" means the State as defined under article 12 of the Constitution
s.2(zb), DPDP Act 2023, verbatim. Read section 2.
Third Schedule (retention)
The DPDP Rules schedule that deems the purpose expired for large e-commerce entities, online gaming intermediaries and social media intermediaries three years after the user last engaged, with 48 hours' notice before erasure (Rule 8).
Verifiable parental consent
Consent of a parent or lawful guardian, required before processing a child's personal data (s.9(1)). Rule 10 requires due diligence that the parent is an identifiable adult, using identity and age details already held, details voluntarily provided, or a virtual token from an authorised entity such as DigiLocker.
Last updated . Report an error.