Resources · Glossary
DPDP terms in plain words
The words you’ll meet in the Act and the Rules, explained simply. General information, not legal advice.
The parties
| Data Fiduciary | The organisation that decides why and how personal data is processed. Usually the business itself. Example: AgriShop. |
| Data Principal | The person the data is about. For a child or a person with a disability, includes the parent or lawful guardian. Example: Ramesh, a farmer. |
| Data Processor | A company that processes data on a fiduciary’s behalf, such as the firm that hosts and runs AgriShop’s app. |
| Consent Manager | A platform registered with the Board that lets people give, manage and withdraw consent across services. |
| Significant Data Fiduciary | A fiduciary the government names for extra duties, based on the volume, sensitivity and risk of its data. |
| Data Protection Officer | An India-based officer a Significant Data Fiduciary must appoint. |
| Data Protection Board | The regulator: it hears complaints, investigates and imposes penalties. |
| Appellate Tribunal | Where decisions of the Board are appealed (TDSAT). |
The data and the activity
| Personal data | Any data about an individual who can be identified by or from it. |
| Digital personal data | Data collected digitally, or collected offline and later digitised. Only this is in scope. |
| Processing | Any operation on data: collection, storage, use, sharing, erasure. |
| Specified purpose | The purpose stated in the notice; processing must stay within it. |
| Personal data breach | Any unauthorised processing, loss or disclosure of personal data, or loss of access to it. |
| Child | Anyone under 18. |
Grounds for processing
| Consent | Free, specific, informed, unconditional and unambiguous, given by clear affirmative action. |
| Notice | A plain-language statement of what data is collected and why, given with or before the consent request. |
| Withdrawal of consent | Must be as easy as giving consent. |
| Legitimate uses | Limited cases where consent is not needed, such as data the person volunteered, employment, a legal duty or an emergency. |
| Verifiable parental consent | Required before processing a child’s data. |
Business obligations
| Reasonable security safeguards | Measures such as encryption, masking, access control, monitoring and backups to protect personal data, with logs kept for one year. |
| Breach intimation | Telling affected people and the Board without delay, with a detailed report to the Board within 72 hours. |
| Retention and erasure | Deleting data once the purpose is served or consent is withdrawn, unless a law requires keeping it. Large e-commerce and social media platforms (2 crore or more users) and online gaming platforms (50 lakh or more) must erase data three years after a user’s last activity, with 48 hours’ notice. |
| Grievance redressal | A published contact, and responses to grievances within a reasonable period of no more than 90 days. |
| DPIA and periodic audit | A yearly impact assessment and independent audit, for Significant Data Fiduciaries. |
| Cross-border transfer | Allowed, except to countries the government restricts. |
Rights and duties
| Right to information | A summary of what data is processed and who it is shared with. |
| Right to correction and erasure | Having data corrected, completed, updated or erased. |
| Right to grievance redressal | Used with the fiduciary first, before approaching the Board. |
| Right to nominate | Naming someone to exercise rights on death or incapacity. |
| Duties of data principal | No false complaints or impersonation. |
Enforcement
| Penalties | Up to ₹250 crore for failing to take security safeguards; up to ₹200 crore for breach-notification and children’s-data failures; other amounts for other breaches. |
| Voluntary undertaking | A commitment a fiduciary gives the Board, which can close proceedings. |
| Exemptions | Some duties don’t apply in limited cases, such as legal claims, investigating offences, court-approved mergers, and Indian firms processing data of people outside India under a contract with a foreign party. Security safeguards still apply. |
Readiness check
Not sure where you stand?
Ten minutes, twenty questions, an instant readiness score. No sign-up needed to see your result.