# DPDP Act glossary: Data Fiduciary, Data Principal and more > Canonical page: https://mksd0398.github.io/dpdp-act-skill/glossary/ > Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting. ## Appellate Tribunal TDSAT. Appeals from Board orders lie within 60 days (s.29). > "Appellate Tribunal" means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997) (s.2(a), verbatim) ## Automated > "automated" means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data (s.2(b), verbatim) ## Board The Data Protection Board of India, an adjudicatory body. It has no rule-making power; the Central Government makes the Rules (s.40). > "Board" means the Data Protection Board of India established by the Central Government under section 18 (s.2(c), verbatim) ## Certain legitimate uses The closed list of non-consent grounds in s.7. There is no legitimate interests ground. > "certain legitimate uses" means the uses referred to in section 7 (s.2(d), verbatim) ## Chairperson > "Chairperson" means the Chairperson of the Board (s.2(e), verbatim) ## Child Anyone under 18. Not 13 or 16 as in other regimes. Tracking, behavioural monitoring and targeted advertising directed at children are banned outright (s.9(3)). > "child" means an individual who has not completed the age of eighteen years (s.2(f), verbatim) ## Consent Manager A Board-registered platform through which people give, manage, review and withdraw consent. Accountable to the Data Principal, not the business. Registration under Rule 4 commences 14 November 2026. > "Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform (s.2(g), verbatim) ## Data > "data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means (s.2(h), verbatim) ## Data Fiduciary The business or body that decides why and how personal data is processed. Closest GDPR analogue: controller. The test is conjunctive, purpose and means (s.2(i)). > "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data (s.2(i), verbatim) ## Data Principal The individual the data is about. Closest GDPR analogue: data subject. For a child it includes the parent or lawful guardian (s.2(j)). > "Data Principal" means the individual to whom the personal data relates and where such individual is— (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf (s.2(j), verbatim) ## Data Processor Processes personal data on a Data Fiduciary's behalf. Must be engaged under a valid contract (s.8(2)). > "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary (s.2(k), verbatim) ## Data Protection Impact Assessment (DPIA) A periodic assessment that Significant Data Fiduciaries must carry out. The Act defines it as a description of Data Principal rights and the purpose of processing, plus the assessment and management of risk to those rights (s.10(2)(c)(i)). Rule 13(1) requires a DPIA and audit every twelve months. ## Data Protection Officer Required only for notified Significant Data Fiduciaries, and must be based in India and responsible to the board of directors (s.10(2)(a)). > "Data Protection Officer" means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10 (s.2(l), verbatim) ## Digital office > "digital office" means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode (s.2(m), verbatim) ## Digital personal data The Act only applies to personal data in digital form, or collected on paper and digitised later (s.3(a)). > "digital personal data" means personal data in digital form (s.2(n), verbatim) ## Eighth Schedule languages The 22 languages in the Eighth Schedule to the Constitution. Notice and the consent request must be available in English or any of them, at the Data Principal's option (s.5(3), s.6(3)). ## Gain > "gain" means— (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration (s.2(o), verbatim) ## Legitimate interests Not a DPDP concept. Unlike the GDPR, the Act has no legitimate interests ground. The only lawful bases are consent (s.6) and the closed list of certain legitimate uses (s.7). ## Loss > "loss" means— (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration (s.2(p), verbatim) ## Member > "Member" means a Member of the Board and includes the Chairperson (s.2(q), verbatim) ## Notification > "notification" means a notification published in the Official Gazette and the expressions "notify" and "notified" shall be construed accordingly (s.2(r), verbatim) ## Person > "person" includes— (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub-clauses (s.2(s), verbatim) ## Personal data Very wide: any data about an identifiable individual. The Act creates no separate sensitive-data category. > "personal data" means any data about an individual who is identifiable by or in relation to such data (s.2(t), verbatim) ## Personal data breach Includes mere loss of access, so ransomware counts. Every breach is notifiable to the Board and each affected individual, with no harm threshold (s.8(6)). > "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data (s.2(u), verbatim) ## Prescribed > "prescribed" means prescribed by rules made under this Act (s.2(v), verbatim) ## Proceeding > "proceeding" means any action taken by the Board under the provisions of this Act (s.2(w), verbatim) ## Processing Wholly or partly automated operations on digital personal data, from collection to erasure. > "processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction (s.2(x), verbatim) ## Sensitive personal data Not a DPDP concept. The Act has no special category: health, biometric, financial and caste data get no extra tier, though sectoral law may still add duties. The old SPDI Rules 2011 category rested on IT Act s.43A, which s.44(2)(a) omitted. ## She Gender-neutral. The Act uses 'she' for every individual. > "she" in relation to an individual includes the reference to such individual irrespective of gender (s.2(y), verbatim) ## Significant Data Fiduciary Exists only once the Central Government notifies an entity or class under s.10(1). Size alone does not make you one, and none had been notified as at the last check. Only SDFs must appoint a DPO. > "Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10 (s.2(z), verbatim) ## Specified purpose The purpose stated in the notice. Consent, retention and erasure all key off it (s.5, s.8(7)). > "specified purpose" means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder (s.2(za), verbatim) ## State The State as defined in Article 12 of the Constitution, which brings government bodies within the Act subject to the s.17 exemptions. > "State" means the State as defined under article 12 of the Constitution (s.2(zb), verbatim) ## Third Schedule (retention) The DPDP Rules schedule that deems the purpose expired for large e-commerce entities, online gaming intermediaries and social media intermediaries three years after the user last engaged, with 48 hours' notice before erasure (Rule 8). ## Verifiable parental consent Consent of a parent or lawful guardian, required before processing a child's personal data (s.9(1)). Rule 10 requires due diligence that the parent is an identifiable adult, using identity and age details already held, details voluntarily provided, or a virtual token from an authorised entity such as DigiLocker.