Short answer
In the DPDP Act, the individual is the “Data Principal”, the organisation deciding why and how data is used is the “Data Fiduciary”, and a service provider acting on its behalf is a “Data Processor”. “Significant Data Fiduciaries” are larger or higher-risk organisations with extra duties.
Key points
- Definitions here are simplified summaries of section 2 of the Act.
- Check the official text before relying on a definition in a legal context.
Key terms
- Data Principal
- The individual to whom the personal data relates. For a child, this includes the parent or lawful guardian; for a person with a disability who cannot act, the lawful guardian.
- Data Fiduciary
- Any person or organisation that, alone or with others, decides the purpose and means of processing personal data. A clinic deciding to collect patient phone numbers for reminders is acting as a Data Fiduciary.
- Data Processor
- A person or organisation that processes personal data on behalf of a Data Fiduciary, such as a cloud provider, CRM tool or SMS vendor.
- Significant Data Fiduciary (SDF)
- A Data Fiduciary or class of them notified by the Central Government based on factors such as the volume and sensitivity of data and risk to individuals. SDFs have extra duties, including a Data Protection Officer based in India, an independent data auditor and periodic impact assessments.
- Personal data
- Any data about an individual who is identifiable by or in relation to that data.
- Digital personal data
- Personal data in digital form, including non-digital personal data that has been digitised.
- Processing
- Wholly or partly automated operations on digital personal data, such as collection, storage, use, sharing and deletion.
- Consent
- Under the Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose.
- Legitimate uses
- Situations listed in section 7 where personal data can be processed without consent, for example where an individual voluntarily provides data for a specified purpose and does not object to its use.
- Notice
- The information a Data Fiduciary must give when asking for consent: what data, for what purpose, how to withdraw consent and exercise rights, and how to complain to the Board.
- Consent Manager
- A registered entity that acts as a single point of contact for individuals to give, manage, review and withdraw consent through an accessible and interoperable platform.
- Personal data breach
- Unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
- Data Protection Board of India
- The body established under the Act to inquire into breaches, direct remedial action and impose penalties. It works digitally by design.
- Verifiable parental consent
- Consent from a parent or lawful guardian that the Data Fiduciary can verify, required before processing a child’s personal data, subject to exemptions in the Rules.
- Data Protection Officer (DPO)
- A person based in India who represents a Significant Data Fiduciary and answers to its board. Other organisations should still publish contact details for someone who can answer questions.
- Data Protection Impact Assessment (DPIA)
- A periodic assessment of risks to individuals from processing. The Act requires it of Significant Data Fiduciaries.
- Grievance redressal
- The route by which an individual raises a complaint with the Data Fiduciary first, before approaching the Board.
- Retention
- How long personal data is kept. Data should be erased when its purpose is served, unless law requires it to be kept.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
- Gazette: G.S.R. 843(E), Act commencement notification, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.