# DPDP dictionary: glossary of data protection terms, A to Z | FOCTTA > Plain-English definitions of 98 terms from India's DPDP Act and Rules and from across foctta.com: roles, rights, breach deadlines, regulators and security products, with their sources. Web page: https://foctta.com/glossary This Markdown copy has the same content as the web page. Built 2026-10-14. --- Glossary # The DPDP dictionary, A to Z 98 terms from the law, the [free course](https://foctta.com/learn) and this site, each in one plain sentence. New to the law itself? Start with [DPDP basics](https://foctta.com/dpdp-basics). (Form on the web page: https://foctta.com/company#contact) A B C D E F G I L M N O P R S T U V W ## A **Adult (Rule 10)** An adult is an individual who has completed eighteen years, when checking a parent under Rule 10. Consent and rights Rules r.10(2)(a) **Appellate Tribunal** Telecom Disputes Settlement and Appellate Tribunal (TDSAT) The Appellate Tribunal is TDSAT, which hears appeals against orders of the Data Protection Board. The law Act s.2(a), s.29 **Authorised entity (Rule 10)** An authorised entity is a body entrusted by law or government to issue identity and age details or tokens. Consent and rights Rules r.10(2)(b) **Automated** Automated is any digital process that can run automatically on instructions, for processing data. The law Act s.2(b) ## B **BFSI** Banking, financial services and insurance The industry group of banks, lenders, brokers and insurers, regulated by RBI, SEBI and IRDAI. Programme **Blocking direction (S.37)** A blocking direction is a Government order to block public access to a Fiduciary penalised in two or more cases. The law Act s.37 **Board inquiry (S.28)** A Board inquiry is the Board's investigation of a breach, run on natural justice and due within six months. The law Act s.28, Rules r.19(9) **Breach notice (Rule 7)** After a personal data breach: tell affected people and the Board without delay, then send the Board a report within 72 hours. Breach and security ## C **CCPA and CPRA** California Consumer Privacy Act and Privacy Rights Act California's privacy laws, giving consumers there rights over the personal data businesses hold. The law **CERT-In** Indian Computer Emergency Response Team India's national cyber-security agency. Most cyber incidents must be reported to it within 6 hours. Breach and security **Certain legitimate uses (S.7)** Certain legitimate uses is the Act's term for the nine section 7 purposes that need no fresh consent. Consent and rights Act s.2(d), s.7 **Chairperson** Chairperson of the Data Protection Board The Chairperson is the head of the Data Protection Board, with general superintendence of its administration. The law Act s.2(e), s.26 **Child** A child is an individual who has not completed the age of eighteen years. Consent and rights Act s.2(f) **Children's data (S.9)** Processing a child's data needs verifiable parental consent, and tracking or targeted ads at children are not allowed. Consent and rights **CMDB** Configuration Management Database IT's register of servers, databases and applications, with their owners. Often kept in ServiceNow. Security products **Commencement** Commencement is the date a provision comes into force; DPDP provisions start in three stages. The law Act s.1(2), Rules r.1 **Consent Manager** A company registered with the Data Protection Board to manage people's consents. A registered legal role, not a software category. The law **Correction and erasure (S.12)** People can ask you to correct, complete, update or erase their personal data. Consent and rights **Cross-border transfer (S.16)** Cross-border transfer is sending personal data abroad; allowed unless the Government restricts a notified country. The law Act s.16(1) ## D **DAKSH** RBI's supervisory portal. Under RBI's 2026 cyber Directions, regulated entities report cyber incidents on it within 6 hours. Breach and security **DAM** Database Activity Monitoring Software that watches who reads or changes data in databases, and flags unusual activity. Security products **Data** Data is information, facts, concepts, opinions or instructions in a form people or machines can communicate or process. The law Act s.2(h) **Data Fiduciary** The organisation that decides why and how personal data is used. Most DPDP duties fall on it. The law **Data Principal** The person the data is about: a customer, employee or user. For a child, the parent also acts. The law **Data Processor** A vendor that handles personal data on a Data Fiduciary's behalf, such as a cloud or payroll provider. The law **Data Protection Board** Data Protection Board of India The regulator that hears DPDP complaints, investigates breaches and imposes penalties. The law **DDR** Data Detection and Response Software that checks each data request as it happens and allows, masks or blocks it, then responds to threats. Security products **Digital Locker service provider** A Digital Locker service provider is a notified intermediary through which identity and age details can be verified. Consent and rights Rules r.10(2)(c) **Digital office** A digital office is one that runs proceedings online, from receiving a complaint or appeal to deciding it. The law Act s.2(m) **Digital personal data** Digital personal data is personal data in digital form, the only kind the Act covers. The law Act s.2(n), s.3 **DPA** Data Processing Agreement The contract that sets how a vendor may handle your personal data, and what happens when it ends. Programme **DPDP Act** Digital Personal Data Protection Act, 2023 India's law on how organisations collect and use personal data, and the rights people have over it. The law **DPDP Rules 2025** Digital Personal Data Protection Rules, 2025 The rules that put the DPDP Act into practice. Notified on 13 November 2025; most duties apply from May 2027. The law **DPIA** Data Protection Impact Assessment A structured check of the privacy risks of a system or process before and while you run it. Programme **DPO** Data Protection Officer The person who answers for data protection. A Significant Data Fiduciary must appoint one based in India. Programme **DSAR** Data Subject (Principal) Access Request A request from a person to see, correct or erase their data. Under DPDP these are rights requests. Programme **DSPM** Data Security Posture Management Software that finds where personal and sensitive data lives, and shows who can reach it and how exposed it is. Security products **Duty of a Data Principal (S.15)** A Data Principal's duty is to obey laws, not impersonate, not file false complaints and give authentic information. Consent and rights Act s.15 ## E **E-commerce entity** An e-commerce entity is anyone running an e-commerce platform under the Consumer Protection Act, excluding marketplace sellers. Programme Rules Third Schedule note (a) **EDR** Endpoint Detection and Response Security software on laptops and servers that spots and stops threats on each machine. Security products **Eighth Schedule languages** An Eighth Schedule language is one listed in the Constitution's Eighth Schedule; notices and consent requests must offer them. Consent and rights Act s.5(3), s.6(3) **Erasure (S.8(7))** Personal data must be erased once its purpose is served or consent is withdrawn, unless a law requires keeping it. Consent and rights **Exemptions (S.17)** An exemption is a case where most DPDP duties do not apply, such as legal claims or preventing offences. The law Act s.17 ## F **First Schedule (Consent Managers)** The First Schedule is the Rules' list of Consent Manager registration conditions (Part A) and obligations (Part B). The law Rules r.4 **Fourth Schedule** The Fourth Schedule is the list of who and what is exempt from verifiable parental consent and the tracking ban. Consent and rights Rules r.12 ## G **G.S.R.** General Statutory Rules G.S.R. is the Gazette numbering series for rules and notifications, such as G.S.R. 846(E) for the Rules. The law **Gain** Gain is a gain in property or services, or a chance to earn more, beyond legitimate remuneration. The law Act s.2(o) **GDPR** General Data Protection Regulation The European Union's data protection law. It applies when you handle personal data of people in the EU. The law **Grievance (S.13)** A complaint to you first. The Rules give you up to 90 days to resolve it; then people can go to the Board. Consent and rights ## I **Identifier (Rule 14(5))** An identifier is a code the Fiduciary issues to identify a person, such as a customer ID or mobile number. Consent and rights Rules r.14(5) **Incapacity (S.14)** Incapacity is inability to exercise DPDP rights due to unsoundness of mind or infirmity of body. Consent and rights Act s.14(2) **Independent data auditor** An independent data auditor is the auditor a Significant Data Fiduciary appoints to evaluate its DPDP compliance. Programme Act s.10(2)(b) **IRDAI** Insurance Regulatory and Development Authority of India The insurance regulator. Insurers report cyber incidents to CERT-In within 6 hours and copy IRDAI. Breach and security ## L **Lawful guardian (Rule 11)** A lawful guardian is a guardian appointed by a court, designated authority or local level committee. Consent and rights Act s.9(1), Rules r.11 **Lawful purpose (S.4)** A lawful purpose is any purpose not expressly forbidden by law. Consent and rights Act s.4(2) **Loss** Loss is a loss of property or interrupted services, or a lost chance to earn remuneration or financial advantage. The law Act s.2(p) ## M **Mediation (S.31)** Mediation is the Board directing parties to settle a complaint through an agreed mediator. The law Act s.31 **Member** Member of the Data Protection Board A Member is a member of the Data Protection Board; the term includes the Chairperson. The law Act s.2(q) ## N **NBFC** Non-Banking Financial Company A lender or finance company regulated by RBI that is not a bank, such as a microfinance firm. Programme **Nomination (S.14)** A person can name someone to exercise their rights if they die or cannot act themselves. Consent and rights **Notification** A notification is a notice published in the Official Gazette; notify and notified follow from it. The law Act s.2(r) ## O **Official Gazette** Gazette of India The Official Gazette is the Government's official journal, where the Act, Rules and notifications are published. The law Act s.2(r) **One-year log retention** One-year log retention is the Rules' minimum period for keeping processing logs and security logs. Breach and security Rules r.6(1)(e), r.8(3) ## P **Person** A person, in the Act, is an individual, Hindu undivided family, company, firm, association, the State or juristic person. The law Act s.2(s) **Person with disability (Rule 11)** A person with disability, for Rule 11, is someone unable to take legally binding decisions despite adequate support. Consent and rights Rules r.11(2)(d) **Personal data** Personal data is any data about an individual who is identifiable by or in relation to that data. The law Act s.2(t) **Personal data breach** A personal data breach is unauthorised or accidental processing that compromises data's confidentiality, integrity or availability. Breach and security Act s.2(u) **PMLA** Prevention of Money-laundering Act, 2002 Requires financial firms to keep transaction and identity records for five years, which can override erasure. Programme **Prescribed** Prescribed is the Act's word for anything set out in rules made under it, such as the DPDP Rules 2025. The law Act s.2(v) **Privacy notice (S.5)** What you must tell people before asking consent: the data, the purpose, how to withdraw and how to complain. Consent and rights **Proceeding** A proceeding is any action the Data Protection Board takes under the Act. The law Act s.2(w) **Processing** Processing is any wholly or partly automated operation on digital personal data, from collection to erasure. The law Act s.2(x) **Proof of consent (S.6(10))** Proof of consent is the Fiduciary's duty to prove notice and consent if questioned in a proceeding. Consent and rights Act s.6(10) ## R **Right to access (S.11)** People can ask what data you hold about them, how it is used and who it was shared with. Consent and rights **ROPA** Record of Processing Activities A register of what personal data you process, why, where it goes and how long you keep it. Programme ## S **Schedule (penalties)** The Schedule is the Act's table of maximum penalties, from Rs 10,000 up to Rs 250 crore. Breach and security Act s.33, Schedule **SDF** Significant Data Fiduciary An organisation the government names for extra duties: an India-based DPO, a yearly DPIA and an independent audit. The law **Search-cum-Selection Committee** A Search-cum-Selection Committee is a panel that recommends people for appointment as Board Chairperson or Members. The law Rules r.17 **SEBI CSCRF** SEBI Cybersecurity and Cyber Resilience Framework SEBI's cyber rules for market entities: a 6-hour incident notice and a portal report within 24 hours. Breach and security **Second Schedule** The Second Schedule is the set of standards for State processing under section 7(b) and for research exemptions. The law Rules r.5, r.16 **Security duties (S.8(4), S.8(5))** Take the technical and organisational measures the Act needs, and reasonable safeguards to prevent a breach. Breach and security **Seventh Schedule** The Seventh Schedule is the list of purposes for which the Government may call for information from Fiduciaries. The law Rules r.23, r.8(3) **She** She is the pronoun the Act uses for any individual, irrespective of gender. The law Act s.2(y) **SIEM and SOAR** The security team's tools: SIEM collects and alerts on security events; SOAR runs automated responses. Security products **Specified purpose** The specified purpose is the purpose stated in the notice given to the Data Principal. Consent and rights Act s.2(za) **SSO and SCIM** SSO lets staff sign in with their company login; SCIM adds and removes their accounts automatically. Security products **Startup (S.17(3))** A startup is a recognised Indian private company, partnership or LLP that the Government may exempt from some duties. The law Act s.17(3) **State** The State is the State as defined in article 12 of the Constitution, including governments and their instrumentalities. The law Act s.2(zb) **Stop processing (S.6(6))** Once consent is withdrawn, you and your vendors must stop using that person's data within a reasonable time. Consent and rights ## T **Techno-legal measures** A techno-legal measure is a digital method the Board and Tribunal use so no one must attend in person. The law Rules r.2(1)(b), r.20 **Third Schedule** The Rules' list of large e-commerce, gaming and social platforms that must erase data of users inactive for three years. Consent and rights **TPRM** Third-Party Risk Management Checking vendors and partners who handle your data: tiering, questionnaires, scoring, contracts and exit. Security products ## U **User account** A user account is a person's online account with a Fiduciary, including profiles, handles, email and mobile number. Consent and rights Rules r.2(1)(c) ## V **Valid consent (S.6(1))** Valid consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Consent and rights Act s.6(1) **Verifiable consent** Verifiable consent is consent of a parent or lawful guardian obtained and checked as Rules 10 and 11 require. Consent and rights Rules r.2(1)(d) **Virtual token** A virtual token is a digital stand-in mapped to real details, used for security or age checks. Breach and security Rules r.6(1)(a), r.10(1)(b) **Voluntary undertaking (S.32)** A voluntary undertaking is a promise accepted by the Board that bars proceedings on its contents. The law Act s.32 ## W **Withdrawal (S.6(4))** People can withdraw consent at any time, and it must be as easy as giving it. Consent and rights No term matches that search. Try a shorter word, or browse the letters above. Definitions are simplified for clarity and checked on 28 September 2026. They are not legal advice. For the law in order, take the [free 12-lesson course](https://foctta.com/learn).