DPDP Act definitions and jargon, in plain words

Much of the difficulty with the DPDP Act is vocabulary. The same handful of terms appear in every proposal, every audit report and every vendor pitch, and they are rarely explained. What follows is that vocabulary in one place. Some of these terms are defined by the Act itself. Others are simply the words the profession uses. Knowing which is which is the difference between following a conversation and being led through one.

Where a term is a common practice rather than a requirement of the Rules, the entry says so. That distinction is the whole point of the page: it is what lets you ask why a particular deliverable is on a proposal.

Core roles and actors

Data Principal

The individual to whom personal data relates. For a child, the parent or lawful guardian acts on the child's behalf. For a person with a disability who has a lawful guardian, the lawful guardian may act as provided under applicable law.

Data Fiduciary

The person or organisation that decides why and how personal data will be processed. Most DPDP responsibilities apply to the Data Fiduciary.

Data Processor

A person or organisation that processes personal data on behalf of a Data Fiduciary.

Consent Manager

A registered entity that provides a platform through which Data Principals can give, manage, review and withdraw consent.

Significant Data Fiduciary (SDF)

A Data Fiduciary specifically notified by the Central Government as a Significant Data Fiduciary. SDFs have additional responsibilities, including a Data Protection Officer, independent data auditor, periodic assessments and audits.

Data Protection Officer (DPO)

The person responsible for overseeing data protection responsibilities. A DPO is specifically required for a Significant Data Fiduciary and must be based in India.

Grievance Officer

The person or function responsible for handling complaints from Data Principals about the processing of their personal data. The Data Fiduciary must provide a grievance mechanism and resolve grievances within a reasonable period not exceeding 90 days.

Data Protection Board of India

The regulatory body established under the DPDP Act to deal with breaches, complaints and other matters under the Act, including imposing penalties where applicable.

Data and processing concepts

Personal Data

Any data about an individual who can be identified from that data or together with other information.

Digital Personal Data

Personal data in digital form.

Processing

Any operation performed on personal data, such as collecting, recording, storing, using, sharing, changing or deleting it.

Purpose Limitation

Personal data should be collected and used for a specific lawful purpose. The actual use of the data should match the purpose communicated to the individual.

Lawful Basis

The legal basis that allows a Data Fiduciary to process personal data. Under DPDP, processing is generally based on consent or a specified legitimate use under the Act.

Legitimate Uses

Specific situations in which personal data may be processed without obtaining consent, as provided under the Act.

Children's Data

Personal data of a child. Under DPDP, a child is an individual below 18 years of age.

Anonymisation

Changing data so that an individual can no longer be identified from it. Whether data remains personal data depends on whether the individual can still be identified.

Data Residency

Where personal data is stored or processed. DPDP does not generally require all personal data to remain in India, although other laws or sector-specific requirements may impose such restrictions.

Cross-Border Data Transfer

Transferring or making personal data available outside India. Such transfers are subject to requirements or restrictions that may be specified by the Central Government and other applicable laws.

Consent and notice

Consent

Permission given by a Data Principal for processing personal data. Consent must be free, specific, informed, unconditional and unambiguous, and must be given through clear affirmative action.

Affirmative Action

A clear and deliberate action showing that the individual agrees to the processing, such as selecting an "I Agree" option.

Free Consent

Consent given voluntarily, without being forced or unfairly made a condition for something unrelated to the processing.

Informed Consent

Consent given after the individual has been clearly told what personal data will be processed and why.

Unconditional Consent

Consent that is not made dependent on unnecessary or unrelated conditions.

Withdrawal of Consent

The Data Principal's ability to withdraw previously given consent. Withdrawing consent must be as easy as giving consent.

Notice

A clear explanation of what personal data is being collected, why it is being processed, and how the individual can withdraw consent, exercise rights and make a complaint.

Standalone Notice

A privacy notice provided separately and clearly, rather than being hidden inside general terms and conditions.

Notice Version

A record identifying the particular version of a privacy notice that was presented to an individual. This is a useful compliance practice for maintaining evidence of what was communicated.

Multilingual Consent

Providing consent information in a language that enables the Data Principal to understand what they are agreeing to. The notice should be clear and understandable.

Data Principal rights

Data Principal Rights

Rights available to individuals under DPDP, including rights relating to access to information, correction and erasure, grievance redressal and nomination, together with the ability to withdraw consent where consent is the basis for processing.

Rights Request

A request made by a Data Principal to exercise one of their rights under DPDP.

Rights Request Timeline

The time within which a Data Fiduciary must handle a rights request or grievance. The Rules require grievances to be resolved within a reasonable period not exceeding 90 days.

Verifiable Parental Consent

Consent from a parent that has been verified using appropriate identity and age information before processing a child's personal data.

Lawful Guardian

A person legally appointed or recognised to act as a guardian for another individual in circumstances covered by the Act and Rules.

DigiLocker

A digital document service that is referred to in the DPDP Rules as one possible source of identity and age information for verifying parental consent.

Contracts, governance and accountability

Data Processing Agreement (DPA)

A contract between a Data Fiduciary and a Data Processor that sets out how personal data will be processed and protected.

Reasonable Security Safeguards

Technical and organisational measures used to protect personal data from unauthorised access, loss, misuse or breach. The DPDP Rules refer to measures such as encryption, masking or tokenisation, access controls, logging and monitoring, backups and appropriate contractual safeguards.

Data Protection Impact Assessment (DPIA)

A structured assessment of the risks that processing may create for Data Principals. DPIAs are specifically required for Significant Data Fiduciaries under the DPDP Rules.

Algorithmic Assessment

For a Significant Data Fiduciary, an assessment of whether technical measures, including algorithmic software used for processing personal data, could create risks to the rights of Data Principals.

Record of Processing Activities (RoPA)

An internal record of an organisation's personal-data processing activities, including what data is processed, why it is processed, where it is processed, who receives it and how long it is retained. RoPA is a common privacy-management practice; it is not specifically named as a standalone requirement in the DPDP Rules.

Independent Data Auditor

An independent auditor responsible for carrying out the audit required for a Significant Data Fiduciary.

Breach, audit and evidence

Personal Data Breach

A security incident involving unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction, loss of access or other compromise of personal data.

Breach Notification

When a personal data breach occurs, the Data Fiduciary must notify affected Data Principals without delay and notify the Data Protection Board without delay. The detailed information required by the Rules must be provided to the Board within 72 hours, unless additional time is allowed.

Consent Record

Evidence showing that a Data Principal gave consent, including relevant information such as the purpose, notice presented, date and time, and method used to obtain consent.

Audit Trail

A record of activities or events that allows an organisation to determine what happened and when. The specific technical method used to maintain an audit trail is an implementation choice.

Implementation and technical terms

The following terms are useful when designing a DPDP solution, but they are not themselves requirements or defined terms under the DPDP Rules.

Data Discovery

Finding personal data across databases, files, applications and other data stores.

Identity Resolution

Matching records from different systems to determine which records relate to the same individual.

Unified Principal Profile

A consolidated view of an individual's personal data held across different systems.

Erasure Job

A process that removes an individual's personal data from systems when deletion is required.

Consent Propagation

Sending a consent or withdrawal decision to systems or Data Processors that need to act on that decision.

Dead-Letter Queue

A temporary holding area for processing requests that could not be successfully delivered or completed and require further action.

Webhook

A mechanism used by one system to automatically send information to another system when an event occurs.

Field-Level Encryption

Encrypting specific pieces of data, such as a PAN or Aadhaar number, rather than encrypting an entire database.

Row-Level Security

A database security mechanism that restricts which records a user or application can access.

TLS

A security protocol used to protect information while it is being transmitted between systems.

Hash

A value generated from data that can be used to detect whether the data has been changed.

Digital Signature

A cryptographic method used to verify the source and integrity of a digital record.

Timestamp

Evidence showing when a particular digital event or record was created or recorded.

Non-Repudiation

The ability to provide evidence that a particular person or system performed or approved an action.

User experience and consent

Dark Patterns

User-interface designs that manipulate or mislead people into making choices they may not otherwise make. Examples include making withdrawal of consent deliberately difficult or hiding important choices.