DPDP Act Glossary
Complex legal terms from the Digital Personal Data Protection Act, 2023, explained in plain English. All definitions are based strictly on the official Act.
Click a letter above to jump, or scroll through all terms below.
Appellate Tribunal
The court-like body where you can appeal if you disagree with a decision made by the Data Protection Board. It is the same tribunal that handles telecom disputes.
Read full explanationAutomated
Any computer-based process that runs on its own without constant human involvement. For example, an algorithm that sorts your emails or a system that automatically backs up files.
Read full explanationCertain Legitimate Uses
Specific situations where a company can process your personal data without asking for your consent. These include emergencies, government benefits, legal obligations, and employment purposes.
Read full explanationChairperson
The head or leader of the Data Protection Board of India. The Chairperson oversees the Board's administrative work and can allocate cases to other Board members.
Read full explanationChild
Anyone below 18 years of age. The DPDP Act provides special protections for children's data, requiring parental consent and banning tracking or targeted ads aimed at kids.
Read full explanationConsent Manager
A registered service that helps you manage all your data consents in one place. Instead of visiting each company's website to withdraw consent, you could use a Consent Manager to do it from a single dashboard.
Read full explanationCross-border Data Transfer
When an Indian company sends personal data to servers or partners located in other countries. The Indian government can restrict which countries are allowed to receive this data.
Read full explanationData
Any information that can be read, understood, or processed, whether by a person or a computer. This includes text, numbers, images, audio, and video.
Read full explanationData Fiduciary
Any organization or person that decides why and how your personal data is collected and used. This includes companies, government agencies, startups, and even individuals running businesses. For example, an e-commerce website, a bank, or a hospital.
Read full explanationData Principal
The person whose personal data is being collected or processed. Essentially, you. If the person is a child or someone with a disability, their parent or lawful guardian acts on their behalf.
Read full explanationData Processor
A third-party company or service that handles personal data for another organization, but does not decide why or how the data is used. For example, a cloud storage provider that stores customer data for an e-commerce site, or an email service that sends bills for a telecom company.
Read full explanationData Protection Impact Assessment
A formal review that Significant Data Fiduciaries must conduct periodically to identify and reduce risks to people's privacy. It is like a safety audit, but for data protection.
Read full explanationData Protection Officer
A dedicated person appointed by large or high-risk companies (Significant Data Fiduciaries) to handle data protection matters. They must be based in India and act as the point of contact for complaints and the Data Protection Board.
Read full explanationDigital Office
A government office that conducts all its work online, from receiving complaints to hearings to final decisions. The Data Protection Board is required to function as a digital office.
Read full explanationDigital Personal Data
Information about a person that exists in electronic or digital format. This includes data stored on computers, phones, cloud servers, or databases, as opposed to paper records.
Read full explanationGain
Any financial benefit or advantage obtained, whether through property, services, or higher earnings. The Board considers whether a company gained financially from a data breach when deciding penalties.
Read full explanationGrievance Redressal
The process through which you can complain to a company about how they handle your data. Every Data Fiduciary must provide a way for you to raise concerns, and they must respond within a set time period.
Read full explanationNomination
The ability to appoint someone you trust to manage your data rights if you die or become unable to do so yourself (due to unsound mind or physical infirmity). It is similar to nominating a beneficiary, but for your data protection rights.
Read full explanationNotice
A clear written statement that a company must give you before or when asking for your data. It must tell you what data is being collected, why, how you can exercise your rights, and how to complain to the Board.
Read full explanationNotification
An official government announcement published in the Gazette of India. When the Act says something will be done 'by notification,' it means the government will formally announce it through this official channel.
Read full explanationPerson
A broad legal term that covers individuals, families, companies, firms, organizations, and even the government. Under the DPDP Act, a 'person' can be a Data Fiduciary, Data Processor, or anyone else the Act applies to.
Read full explanationPersonal Data
Any information that can identify you, directly or indirectly. This includes your name, phone number, email, address, Aadhaar number, photos, location data, and even online identifiers like IP addresses or cookie IDs.
Read full explanationPersonal Data Breach
Any incident where personal data is exposed, stolen, lost, or misused without permission. This includes hacking, accidental leaks, unauthorized sharing, or even accidental deletion of data. Companies must report breaches to the Board and affected individuals.
Read full explanationPrescribed
Something that will be detailed in official rules created by the government under the DPDP Act. The Act often says things will be done 'as prescribed,' meaning the specific procedures will be set out in future rule notifications.
Read full explanationProceeding
Any official action or process carried out by the Data Protection Board, such as investigating a complaint, conducting a hearing, or imposing a fine.
Read full explanationProcessing
Any action done with personal data using computers or digital systems. This covers the entire lifecycle: collecting, storing, organizing, analyzing, sharing, and deleting data. Even automated decisions made by AI fall under processing.
Read full explanationShe
The Act uses 'she' and 'her' as gender-neutral pronouns. This means every reference to 'she' or 'her' in the Act applies to all individuals regardless of gender.
Read full explanationSignificant Data Fiduciary
Large or high-risk companies that the government specifically designates due to the volume or sensitivity of data they handle, or because their operations affect public order, electoral democracy, or national security. They have extra obligations like appointing a Data Protection Officer and conducting regular audits.
Read full explanationSpecified Purpose
The specific reason a company gives for collecting your data, as stated in their notice. A company can only use your data for this stated purpose and must stop using it once that purpose is fulfilled.
Read full explanationState
The government and its agencies, including central and state governments, local authorities, and other bodies under their control. The Constitution's Article 12 defines which entities count as 'State.'
Read full explanationWant to read the full Act?
Explore all 9 chapters and 44 sections with easy-to-understand explanations.