DPDP glossary
DPDP Act Glossary: Key Terms Explained
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
Under India’s DPDP Act, 2023, a Data Fiduciary is the organisation that decides why and how personal data is processed, a Data Principal is the individual the data is about, and a Data Processor processes data on a fiduciary’s behalf. Personal data is any data about an identifiable individual, and a personal data breach is any unauthorised processing or loss that compromises its confidentiality, integrity or availability.
- Data Fiduciary
- Decides the purpose and means of processing (Section 2(i))
- Data Principal
- The individual the data relates to (Section 2(j))
- Data Processor
- Processes data on behalf of a fiduciary (Section 2(k))
- Child
- Anyone under 18 (Section 2(f))
Key DPDP terms
Definitions from Section 2 of the Digital Personal Data Protection Act, 2023, in plain English. Section references point to the official text.
| Term | Meaning | Section |
|---|---|---|
| Data Fiduciary | Any person who, alone or with others, determines the purpose and means of processing personal data. Usually your business. | 2(i) |
| Data Principal | The individual the personal data relates to. For a child, includes the parents or lawful guardian; for a person with disability, includes their lawful guardian. | 2(j) |
| Data Processor | Any person who processes personal data on behalf of a Data Fiduciary, such as a cloud, CRM, payroll or marketing vendor. | 2(k) |
| Personal data | Any data about an individual who is identifiable by or in relation to that data. | 2(t) |
| Digital personal data | Personal data in digital form. The Act covers this, including paper data that is later digitised. | 2(n), 3 |
| Processing | Any wholly or partly automated operation on digital personal data: collection, storage, use, sharing, disclosure, erasure and more. | 2(x) |
| Personal data breach | Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability. | 2(u) |
| Specified purpose | The purpose stated in the notice given to the Data Principal. | 2(za) |
| Child | An individual who has not completed 18 years. Processing their data needs verifiable parental consent. | 2(f), 9 |
| Consent Manager | A person registered with the Board who gives individuals one accessible, transparent and interoperable platform to give, manage, review and withdraw consent. | 2(g), Rule 4 |
| Significant Data Fiduciary (SDF) | A Data Fiduciary, or class of them, notified by the Central Government based on factors such as the volume and sensitivity of data. SDFs have extra duties. | 2(z), 10 |
| Data Protection Officer (DPO) | An individual appointed by a Significant Data Fiduciary, based in India, as the point of contact for grievances. | 2(l), 10(2) |
| Data Protection Board of India | The body established under Section 18 that inquires into breaches and imposes penalties. | 2(c), 18 |
| Certain legitimate uses | Situations listed in Section 7 where personal data may be processed without consent, such as data voluntarily provided for a specified purpose or employment-related processing. | 2(d), 7 |
Which role is your business?
Most businesses are Data Fiduciaries for their own customers, employees and leads, and Data Processors when they handle personal data for a client. A software company building a CRM for a client is usually that client’s Data Processor for the client’s customer data. The role decides who carries which obligations, so map it for every data flow.
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
What is a Data Fiduciary under the DPDP Act?+
A Data Fiduciary is any person or organisation that, alone or with others, determines the purpose and means of processing personal data (Section 2(i) of the DPDP Act, 2023). It carries the main compliance obligations.
What is a Data Principal?+
A Data Principal is the individual the personal data relates to. For a child it includes the parents or lawful guardian, and for a person with disability it includes their lawful guardian (Section 2(j)).
What is the difference between a Data Fiduciary and a Data Processor?+
The Data Fiduciary decides why and how personal data is processed; the Data Processor processes it on the fiduciary’s behalf. The fiduciary remains responsible for compliance, including processing done by its processors.
What counts as personal data under the DPDP Act?+
Any data about an individual who is identifiable by or in relation to that data (Section 2(t)), such as name, phone number, email, address, ID numbers, photos or online identifiers, when held in digital form.
Who is a child under the DPDP Act?+
Anyone who has not completed 18 years of age (Section 2(f)). Processing a child’s personal data requires verifiable consent of the parent or lawful guardian.
Related guides
Sources
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.