Glossary

The DPDP dictionary, A to Z

98 terms from the law, the free course and this site, each in one plain sentence. New to the law itself? Start with DPDP basics.

A

Adult (Rule 10): An adult is an individual who has completed eighteen years, when checking a parent under Rule 10.; Consent and rightsRules r.10(2)(a)
Appellate TribunalTelecom Disputes Settlement and Appellate Tribunal (TDSAT): The Appellate Tribunal is TDSAT, which hears appeals against orders of the Data Protection Board.; The lawAct s.2(a), s.29
Authorised entity (Rule 10): An authorised entity is a body entrusted by law or government to issue identity and age details or tokens.; Consent and rightsRules r.10(2)(b)
Automated: Automated is any digital process that can run automatically on instructions, for processing data.; The lawAct s.2(b)

B

BFSIBanking, financial services and insurance: The industry group of banks, lenders, brokers and insurers, regulated by RBI, SEBI and IRDAI.; Programme
Blocking direction (S.37): A blocking direction is a Government order to block public access to a Fiduciary penalised in two or more cases.; The lawAct s.37
Board inquiry (S.28): A Board inquiry is the Board's investigation of a breach, run on natural justice and due within six months.; The lawAct s.28, Rules r.19(9)
Breach notice (Rule 7): After a personal data breach: tell affected people and the Board without delay, then send the Board a report within 72 hours.; Breach and security

C

CCPA and CPRACalifornia Consumer Privacy Act and Privacy Rights Act: California's privacy laws, giving consumers there rights over the personal data businesses hold.; The law
CERT-InIndian Computer Emergency Response Team: India's national cyber-security agency. Most cyber incidents must be reported to it within 6 hours.; Breach and security
Certain legitimate uses (S.7): Certain legitimate uses is the Act's term for the nine section 7 purposes that need no fresh consent.; Consent and rightsAct s.2(d), s.7
ChairpersonChairperson of the Data Protection Board: The Chairperson is the head of the Data Protection Board, with general superintendence of its administration.; The lawAct s.2(e), s.26
Child: A child is an individual who has not completed the age of eighteen years.; Consent and rightsAct s.2(f)
Children's data (S.9): Processing a child's data needs verifiable parental consent, and tracking or targeted ads at children are not allowed.; Consent and rights
CMDBConfiguration Management Database: IT's register of servers, databases and applications, with their owners. Often kept in ServiceNow.; Security products
Commencement: Commencement is the date a provision comes into force; DPDP provisions start in three stages.; The lawAct s.1(2), Rules r.1
Consent Manager: A company registered with the Data Protection Board to manage people's consents. A registered legal role, not a software category.; The law
Correction and erasure (S.12): People can ask you to correct, complete, update or erase their personal data.; Consent and rights
Cross-border transfer (S.16): Cross-border transfer is sending personal data abroad; allowed unless the Government restricts a notified country.; The lawAct s.16(1)

D

DAKSH: RBI's supervisory portal. Under RBI's 2026 cyber Directions, regulated entities report cyber incidents on it within 6 hours.; Breach and security
DAMDatabase Activity Monitoring: Software that watches who reads or changes data in databases, and flags unusual activity.; Security products
Data: Data is information, facts, concepts, opinions or instructions in a form people or machines can communicate or process.; The lawAct s.2(h)
Data Fiduciary: The organisation that decides why and how personal data is used. Most DPDP duties fall on it.; The law
Data Principal: The person the data is about: a customer, employee or user. For a child, the parent also acts.; The law
Data Processor: A vendor that handles personal data on a Data Fiduciary's behalf, such as a cloud or payroll provider.; The law
Data Protection BoardData Protection Board of India: The regulator that hears DPDP complaints, investigates breaches and imposes penalties.; The law
DDRData Detection and Response: Software that checks each data request as it happens and allows, masks or blocks it, then responds to threats.; Security products
Digital Locker service provider: A Digital Locker service provider is a notified intermediary through which identity and age details can be verified.; Consent and rightsRules r.10(2)(c)
Digital office: A digital office is one that runs proceedings online, from receiving a complaint or appeal to deciding it.; The lawAct s.2(m)
Digital personal data: Digital personal data is personal data in digital form, the only kind the Act covers.; The lawAct s.2(n), s.3
DPAData Processing Agreement: The contract that sets how a vendor may handle your personal data, and what happens when it ends.; Programme
DPDP ActDigital Personal Data Protection Act, 2023: India's law on how organisations collect and use personal data, and the rights people have over it.; The law
DPDP Rules 2025Digital Personal Data Protection Rules, 2025: The rules that put the DPDP Act into practice. Notified on 13 November 2025; most duties apply from May 2027.; The law
DPIAData Protection Impact Assessment: A structured check of the privacy risks of a system or process before and while you run it.; Programme
DPOData Protection Officer: The person who answers for data protection. A Significant Data Fiduciary must appoint one based in India.; Programme
DSARData Subject (Principal) Access Request: A request from a person to see, correct or erase their data. Under DPDP these are rights requests.; Programme
DSPMData Security Posture Management: Software that finds where personal and sensitive data lives, and shows who can reach it and how exposed it is.; Security products
Duty of a Data Principal (S.15): A Data Principal's duty is to obey laws, not impersonate, not file false complaints and give authentic information.; Consent and rightsAct s.15

E

E-commerce entity: An e-commerce entity is anyone running an e-commerce platform under the Consumer Protection Act, excluding marketplace sellers.; ProgrammeRules Third Schedule note (a)
EDREndpoint Detection and Response: Security software on laptops and servers that spots and stops threats on each machine.; Security products
Eighth Schedule languages: An Eighth Schedule language is one listed in the Constitution's Eighth Schedule; notices and consent requests must offer them.; Consent and rightsAct s.5(3), s.6(3)
Erasure (S.8(7)): Personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires keeping it.; Consent and rights
Exemptions (S.17): An exemption is a case where most DPDP duties do not apply, such as legal claims or preventing offences.; The lawAct s.17

F

First Schedule (Consent Managers): The First Schedule is the Rules' list of Consent Manager registration conditions (Part A) and obligations (Part B).; The lawRules r.4
Fourth Schedule: The Fourth Schedule is the list of who and what is exempt from verifiable parental consent and the tracking ban.; Consent and rightsRules r.12

G

G.S.R.General Statutory Rules: G.S.R. is the Gazette numbering series for rules and notifications, such as G.S.R. 846(E) for the Rules.; The law
Gain: Gain is a gain in property or services, or a chance to earn more, beyond legitimate remuneration.; The lawAct s.2(o)
GDPRGeneral Data Protection Regulation: The European Union's data protection law. It applies when you handle personal data of people in the EU.; The law
Grievance (S.13): A complaint to you first. The Rules give you up to 90 days to resolve it; then people can go to the Board.; Consent and rights

I

Identifier (Rule 14(5)): An identifier is a code the Fiduciary issues to identify a person, such as a customer ID or mobile number.; Consent and rightsRules r.14(5)
Incapacity (S.14): Incapacity is inability to exercise DPDP rights due to unsoundness of mind or infirmity of body.; Consent and rightsAct s.14(2)
Independent data auditor: An independent data auditor is the auditor a Significant Data Fiduciary appoints to evaluate its DPDP compliance.; ProgrammeAct s.10(2)(b)
IRDAIInsurance Regulatory and Development Authority of India: The insurance regulator. Insurers report cyber incidents to CERT-In within 6 hours and copy IRDAI.; Breach and security

L

Lawful guardian (Rule 11): A lawful guardian is a guardian appointed by a court, designated authority or local level committee.; Consent and rightsAct s.9(1), Rules r.11
Lawful purpose (S.4): A lawful purpose is any purpose not expressly forbidden by law.; Consent and rightsAct s.4(2)
Loss: Loss is a loss of property or interrupted services, or a lost chance to earn remuneration or financial advantage.; The lawAct s.2(p)

M

Mediation (S.31): Mediation is the Board directing parties to settle a complaint through an agreed mediator.; The lawAct s.31
MemberMember of the Data Protection Board: A Member is a member of the Data Protection Board; the term includes the Chairperson.; The lawAct s.2(q)

N

NBFCNon-Banking Financial Company: A lender or finance company regulated by RBI that is not a bank, such as a microfinance firm.; Programme
Nomination (S.14): A person can name someone to exercise their rights if they die or cannot act themselves.; Consent and rights
Notification: A notification is a notice published in the Official Gazette; notify and notified follow from it.; The lawAct s.2(r)

O

Official GazetteGazette of India: The Official Gazette is the Government's official journal, where the Act, Rules and notifications are published.; The lawAct s.2(r)
One-year log retention: One-year log retention is the Rules' minimum period for keeping processing logs and security logs.; Breach and securityRules r.6(1)(e), r.8(3)

P

Person: A person, in the Act, is an individual, Hindu undivided family, company, firm, association, the State or juristic person.; The lawAct s.2(s)
Person with disability (Rule 11): A person with disability, for Rule 11, is someone unable to take legally binding decisions despite adequate support.; Consent and rightsRules r.11(2)(d)
Personal data: Personal data is any data about an individual who is identifiable by or in relation to that data.; The lawAct s.2(t)
Personal data breach: A personal data breach is unauthorised or accidental processing that compromises data's confidentiality, integrity or availability.; Breach and securityAct s.2(u)
PMLAPrevention of Money-laundering Act, 2002: Requires financial firms to keep transaction and identity records for five years, which can override erasure.; Programme
Prescribed: Prescribed is the Act's word for anything set out in rules made under it, such as the DPDP Rules 2025.; The lawAct s.2(v)
Privacy notice (S.5): What you must tell people before asking consent: the data, the purpose, how to withdraw and how to complain.; Consent and rights
Proceeding: A proceeding is any action the Data Protection Board takes under the Act.; The lawAct s.2(w)
Processing: Processing is any wholly or partly automated operation on digital personal data, from collection to erasure.; The lawAct s.2(x)
Proof of consent (S.6(10)): Proof of consent is the Fiduciary's duty to prove notice and consent if questioned in a proceeding.; Consent and rightsAct s.6(10)

R

Right to access (S.11): People can ask what data you hold about them, how it is used and who it was shared with.; Consent and rights
ROPARecord of Processing Activities: A register of what personal data you process, why, where it goes and how long you keep it.; Programme

S

Schedule (penalties): The Schedule is the Act's table of maximum penalties, from Rs 10,000 up to Rs 250 crore.; Breach and securityAct s.33, Schedule
SDFSignificant Data Fiduciary: An organisation the government names for extra duties: an India-based DPO, a yearly DPIA and an independent audit.; The law
Search-cum-Selection Committee: A Search-cum-Selection Committee is a panel that recommends people for appointment as Board Chairperson or Members.; The lawRules r.17
SEBI CSCRFSEBI Cybersecurity and Cyber Resilience Framework: SEBI's cyber rules for market entities: a 6-hour incident notice and a portal report within 24 hours.; Breach and security
Second Schedule: The Second Schedule is the set of standards for State processing under section 7(b) and for research exemptions.; The lawRules r.5, r.16
Security duties (S.8(4), S.8(5)): Take the technical and organisational measures the Act needs, and reasonable safeguards to prevent a breach.; Breach and security
Seventh Schedule: The Seventh Schedule is the list of purposes for which the Government may call for information from Fiduciaries.; The lawRules r.23, r.8(3)
She: She is the pronoun the Act uses for any individual, irrespective of gender.; The lawAct s.2(y)
SIEM and SOAR: The security team's tools: SIEM collects and alerts on security events; SOAR runs automated responses.; Security products
Specified purpose: The specified purpose is the purpose stated in the notice given to the Data Principal.; Consent and rightsAct s.2(za)
SSO and SCIM: SSO lets staff sign in with their company login; SCIM adds and removes their accounts automatically.; Security products
Startup (S.17(3)): A startup is a recognised Indian private company, partnership or LLP that the Government may exempt from some duties.; The lawAct s.17(3)
State: The State is the State as defined in article 12 of the Constitution, including governments and their instrumentalities.; The lawAct s.2(zb)
Stop processing (S.6(6)): Once consent is withdrawn, you and your vendors must stop using that person's data within a reasonable time.; Consent and rights

T

Techno-legal measures: A techno-legal measure is a digital method the Board and Tribunal use so no one must attend in person.; The lawRules r.2(1)(b), r.20
Third Schedule: The Rules' list of large e-commerce, gaming and social platforms that must erase data of users inactive for three years.; Consent and rights
TPRMThird-Party Risk Management: Checking vendors and partners who handle your data: tiering, questionnaires, scoring, contracts and exit.; Security products

U

User account: A user account is a person's online account with a Fiduciary, including profiles, handles, email and mobile number.; Consent and rightsRules r.2(1)(c)

V

Valid consent (S.6(1)): Valid consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.; Consent and rightsAct s.6(1)
Verifiable consent: Verifiable consent is consent of a parent or lawful guardian obtained and checked as Rules 10 and 11 require.; Consent and rightsRules r.2(1)(d)
Virtual token: A virtual token is a digital stand-in mapped to real details, used for security or age checks.; Breach and securityRules r.6(1)(a), r.10(1)(b)
Voluntary undertaking (S.32): A voluntary undertaking is a promise accepted by the Board that bars proceedings on its contents.; The lawAct s.32

W

Withdrawal (S.6(4)): People can withdraw consent at any time, and it must be as easy as giving it.; Consent and rights

Definitions are simplified for clarity and checked on 28 September 2026. They are not legal advice. For the law in order, take the free 12-lesson course.