DPDP Glossary

Under DPDP Rules 2025, Data Fiduciaries must notify the Data Protection Board of a personal data breach within 72 hours of becoming aware of it, unless a longer period is permitted.

Rule 9(1), DPDP Rules 2025

An additional obligation on Significant Data Fiduciaries to publish information about the logic involved in automated decision-making that significantly affects Data Principals.

Section 10(2)(b), DPDP Act 2023

Processing that irreversibly removes the ability to identify a Data Principal from personal data. Anonymised data falls outside the scope of the DPDP Act once true anonymisation is achieved.

Section 2(3), DPDP Act 2023

The Telecom Disputes Settlement and Appellate Tribunal (TDSAT) serves as the appellate body for appeals against orders of the Data Protection Board of India.

Section 29, DPDP Act 2023

Significant Data Fiduciaries must cause periodic data audits by an independent data auditor and publish the audit report as prescribed under the DPDP Rules 2025.

Rule 11, DPDP Rules 2025

Processing using automated means that produces legal or similarly significant effects on Data Principals. SDFs must enable Data Principals to request review of such decisions.

Section 10(2)(b), DPDP Act 2023

The Data Protection Board adjudicates complaints, conducts inquiries, and may impose penalties after giving the Data Fiduciary opportunity of being heard.

Section 27, DPDP Act 2023

Mandatory notification to the Data Protection Board and affected Data Principals when a personal data breach occurs, within the prescribed timeline under DPDP Rules 2025.

Rule 9, DPDP Rules 2025

Data Fiduciaries must maintain records of all personal data breaches including nature, scope, affected data, remedial actions, and notification details as prescribed.

Rule 9(3), DPDP Rules 2025

Under the DPDP Act, a child is an individual who has not completed 18 years of age. Enhanced protections apply to all processing of children's personal data.

Section 2(2), DPDP Act 2023

Personal data of a child (individual below 18 years). Processing requires verifiable parental consent and prohibits behavioural tracking or targeted advertising directed at children.

Section 9, DPDP Act 2023

Free, specific, informed, unconditional, and unambiguous indication of the Data Principal's agreement to processing of personal data for a specified purpose, given through a clear affirmative action.

Section 6, DPDP Act 2023

Digital record of consent including timestamp, purpose, data categories, and mechanism used, maintained by Data Fiduciary or Consent Manager for audit purposes.

Rule 4, DPDP Rules 2025

A registered entity that acts as a single point of contact enabling Data Principals to give, manage, review, and withdraw consent across multiple Data Fiduciaries through an accessible platform.

Section 6(7), DPDP Act 2023; Rule 5, DPDP Rules 2025

The Data Principal's right to withdraw consent at any time. Withdrawal must be as easy as giving consent, and the Data Fiduciary must cease processing within a reasonable time.

Section 6(6), DPDP Act 2023

Upon consent withdrawal, the Data Fiduciary must cease processing and erase data unless retention is required by law or another lawful basis applies.

Section 6(6), DPDP Act 2023

Transfer of digital personal data outside India. Permitted to countries or territories notified by the Central Government, subject to conditions and restrictions as may be prescribed.

Section 16, DPDP Act 2023; Rule 12, DPDP Rules 2025

An independent auditor appointed by a Significant Data Fiduciary to conduct periodic audits of data processing practices and compliance with the DPDP Act and Rules.

Rule 11, DPDP Rules 2025

Any person who alone or in conjunction with others determines the purpose and means of processing personal data. Primary accountability holder under the DPDP framework.

Section 2(5), DPDP Act 2023

Requirement to store or process data within India. The DPDP Act permits cross-border transfer to notified countries rather than mandating blanket localisation.

Section 16, DPDP Act 2023

While not explicitly named in the DPDP Act, the access right enables Data Principals to obtain their data summary, supporting portability as an industry best practice.

Section 11, DPDP Act 2023

The individual to whom the personal data relates. Includes persons acting in personal capacity and, in context of children's data, parents or lawful guardians.

Section 2(6), DPDP Act 2023

Data Principals must not register false grievances, suppress material information, or furnish false particulars when applying for documents or services.

Section 15, DPDP Act 2023

Any person who processes personal data on behalf of a Data Fiduciary. Processors act under contract and do not determine the purpose of processing independently.

Section 2(9), DPDP Act 2023

The statutory regulatory body established under the DPDP Act to monitor compliance, receive breach notifications, adjudicate disputes, and impose penalties for violations.

Section 18, DPDP Act 2023

A systematic assessment required of Significant Data Fiduciaries to identify and mitigate risks to Data Principals from processing operations, particularly those involving new technologies or large-scale profiling.

Section 10(2)(a), DPDP Act 2023; Rule 10, DPDP Rules 2025

An individual appointed by a Significant Data Fiduciary based in India, responsible for monitoring compliance, cooperating with the Board, and serving as contact point for grievances.

Section 10(1)(a), DPDP Act 2023

Personal data must not be retained beyond the period necessary to satisfy the purpose for which it was collected, unless retention is required by law.

Section 8(7), DPDP Act 2023

Processing permitted without explicit consent under specified legitimate uses including voluntary provision, state functions, employment, medical emergencies, and legal compliance.

Section 7, DPDP Act 2023

Personal data in digital form. The DPDP Act primarily governs digital personal data; non-digital data converted to digital form is also covered.

Section 2(8), DPDP Act 2023

Processing employee personal data for recruitment, employment, attendance, performance evaluation, and related purposes without consent, as a specified legitimate use under Section 7.

Section 7(1)(b), DPDP Act 2023

Security safeguard requiring encryption of personal data at rest and in transit as part of reasonable security measures under DPDP Rules 2025.

Rule 8(1), DPDP Rules 2025

Processing exempt from certain DPDP provisions for research, archival, statistical purposes, or enforcement of legal rights, subject to prescribed safeguards.

Section 17, DPDP Act 2023

The Data Fiduciary bears primary responsibility for compliance regardless of whether processing is performed directly or through a Data Processor.

Section 8(1), DPDP Act 2023

Consent given without coercion, undue influence, or conditioning of service on consent for purposes beyond what is necessary for providing the service.

Section 6(1), DPDP Act 2023

Officer appointed by every Data Fiduciary to address Data Principal grievances. Must be based in India and respond within the timeline prescribed under DPDP Rules 2025.

Rule 6, DPDP Rules 2025

Mechanism whereby Data Fiduciaries must respond to Data Principal complaints within prescribed timelines. Unresolved grievances may be escalated to the Data Protection Board.

Section 13, DPDP Act 2023; Rule 6, DPDP Rules 2025

Data Fiduciaries must acknowledge and resolve Data Principal grievances within the period prescribed under DPDP Rules 2025, typically within 90 days.

Rule 6(2), DPDP Rules 2025

Any bodily harm, distortion of identity, harassment, loss of reputation, loss of employment, or any significant economic loss or mental injury to the Data Principal.

Section 2(4), DPDP Act 2023

Obligation to take prompt steps to mitigate harm to Data Principals upon discovery of a personal data breach or compliance failure.

Rule 9(2), DPDP Rules 2025

Process to verify Data Principal identity before responding to rights requests or grievances, preventing unauthorised access to personal data.

Rule 6(3), DPDP Rules 2025

Documented procedures for detecting, containing, investigating, and notifying personal data breaches within the 72-hour timeline prescribed under DPDP Rules 2025.

Rule 9, DPDP Rules 2025

A Consent Manager must operate independently of Data Fiduciaries, maintain fiduciary duty to Data Principals, and be registered with the Data Protection Board.

Rule 5, DPDP Rules 2025

Consent preceded by a clear and itemised notice describing personal data to be collected, purpose of processing, rights of the Data Principal, and grievance redressal mechanism.

Section 5 & 6, DPDP Act 2023

Notice presented in clear and plain language, itemising each category of personal data and specific purpose for which it will be processed, as required under DPDP Rules 2025.

Rule 3, DPDP Rules 2025

Where two or more Data Fiduciaries jointly determine purposes and means of processing, they share accountability and must define respective obligations contractually.

Section 8(2), DPDP Act 2023

Processing is lawful only when based on consent of the Data Principal or one of the legitimate uses specified under Section 7 of the DPDP Act.

Section 4, DPDP Act 2023

Ten specified grounds under Section 7 permitting processing without consent, including voluntary provision, state functions, compliance with law, medical emergencies, and employment.

Section 7, DPDP Act 2023

Processing personal data to respond to a medical emergency involving a threat to life or immediate health of the Data Principal or any other individual, without prior consent.

Section 7(1)(d), DPDP Act 2023

Notice must be provided in English or any language specified in the Eighth Schedule of the Constitution, ensuring accessibility for diverse Data Principals.

Rule 3(2), DPDP Rules 2025

Before or at the time of seeking consent, Data Fiduciaries must provide notice in English or any language in the Eighth Schedule describing data, purpose, and rights.

Section 5, DPDP Act 2023; Rule 3, DPDP Rules 2025

Countries or territories outside India to which cross-border transfer of personal data is permitted, as notified by the Central Government under Section 16.

Section 16, DPDP Act 2023; Rule 12, DPDP Rules 2025

Financial penalties up to ₹250 crore for violations including failure to implement security safeguards, notify breaches, protect children's data, or comply with SDF obligations.

Section 33, DPDP Act 2023

Any data about an individual who is identifiable by or in relation to such data. Includes direct identifiers and data that can reasonably identify an individual when combined.

Section 2(7), DPDP Act 2023

Any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that compromises confidentiality, integrity, or availability.

Section 2(11), DPDP Act 2023

Wholly or partly automated operation performed on digital personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or erasure.

Section 2(10), DPDP Act 2023

Written contract between Data Fiduciary and Data Processor specifying scope, duration, nature of processing, and obligations including security safeguards and breach notification duties.

Section 8(3), DPDP Act 2023

Automated processing of personal data to evaluate personal aspects relating to a Data Principal. SDFs using profiling must conduct DPIA and enable Data Principal review.

Section 10(2), DPDP Act 2023

Processing that replaces identifying fields with pseudonyms so data cannot be attributed to a Data Principal without additional information kept separately.

Rule 8(2), DPDP Rules 2025

Processing by the State or its instrumentalities for provision of subsidies, benefits, services, licences, or permits, as a legitimate use under Section 7.

Section 7(1)(a), DPDP Act 2023

Personal data must be processed only for the purpose specified in the notice or for which consent was given, and not for any purpose incompatible with the original purpose.

Section 4(1)(a), DPDP Act 2023

Technical and organisational measures appropriate to the risk, including encryption, access controls, and security practices as prescribed under DPDP Rules 2025.

Section 8(5), DPDP Act 2023; Rule 8, DPDP Rules 2025

Cross-border transfer prohibited to countries not notified by the Central Government, or where Government has restricted transfer to specific countries.

Section 16(2), DPDP Act 2023

The Data Principal's right to obtain a summary of personal data being processed and the processing activities undertaken, including identities of other Data Fiduciaries with whom data has been shared.

Section 11, DPDP Act 2023

The Data Principal's right to have inaccurate or misleading personal data corrected and to have incomplete personal data completed.

Section 11, DPDP Act 2023

The Data Principal's right to have personal data erased when consent is withdrawn, data is no longer necessary, or processing was unlawful, subject to retention obligations.

Section 12, DPDP Act 2023

The Data Principal's right to nominate another individual who shall exercise their rights under the DPDP Act in the event of death or incapacity.

Section 14, DPDP Act 2023

Factors for SDF designation include volume of personal data processed, sensitivity of data, risk to rights of Data Principals, potential impact on electoral democracy, security of state, and public order.

Section 10, DPDP Act 2023

The Central Government may notify an entity as a Significant Data Fiduciary based on volume and sensitivity of data, risk of harm, potential impact on sovereignty, and public order.

Section 10, DPDP Act 2023

Significant Data Fiduciaries must periodically review and update DPIA, security measures, and audit findings to address evolving processing risks.

Rule 10(4), DPDP Rules 2025

Measures including encryption, pseudonymisation, access management, and incident response to protect personal data against unauthorised access, breach, or destruction.

Rule 8, DPDP Rules 2025

Processing likely to result in significant harm to Data Principals triggers mandatory DPIA requirements, including large-scale processing of sensitive categories or systematic monitoring.

Rule 10(2), DPDP Rules 2025

Consent limited to personal data necessary for the specified purpose. Blanket or bundled consent covering unrelated purposes is not valid under the DPDP Act.

Section 6(1), DPDP Act 2023

The Central Government, State Government, or any instrumentality thereof acting as Data Fiduciary, subject to modified obligations and exemptions under the Act.

Section 17, DPDP Act 2023

A Data Processor engaged by another Data Processor. The primary Data Fiduciary remains accountable and must ensure contractual flow-down of DPDP obligations.

Section 8(3), DPDP Act 2023

Prohibited practice of tracking or behavioural monitoring of children for targeted advertising. Data Fiduciaries must not process children's data for this purpose.

Section 9(2), DPDP Act 2023

The DPDP Act applies to processing of digital personal data within India and to processing outside India if connected to offering goods or services to Data Principals in India.

Section 3, DPDP Act 2023

Assessment of risks associated with cross-border transfer of personal data, evaluating adequacy of protections in the destination country and supplementary safeguards required.

Rule 12, DPDP Rules 2025

Data Fiduciaries must maintain transparency about processing activities through notices, privacy policies, and responses to Data Principal access requests.

Section 5, DPDP Act 2023

Consent given through a clear affirmative action such as ticking a box or signing a form. Pre-ticked boxes, silence, or inactivity do not constitute valid consent.

Section 6(1), DPDP Act 2023

Consent not made conditional on acceptance of processing beyond what is necessary for the primary service. Denial of unrelated consent cannot be grounds for service denial.

Section 6(1), DPDP Act 2023

Assessment of Data Processors and third-party vendors for DPDP compliance before engagement, including security practices, breach history, and contractual safeguards.

Section 8(3), DPDP Act 2023

Consent that can be demonstrated and audited, with records maintained showing what the Data Principal agreed to, when, and through what mechanism.

Section 6, DPDP Act 2023; Rule 4, DPDP Rules 2025

Consent obtained from a parent or lawful guardian before processing a child's personal data, verified through methods prescribed under DPDP Rules 2025.

Section 9(1), DPDP Act 2023; Rule 7, DPDP Rules 2025

Legitimate use where a Data Principal voluntarily provides personal data and has not indicated objection to its use for the specified purpose.

Section 7(1)(a), DPDP Act 2023

Colloquial term for countries notified by the Central Government as permitted destinations for cross-border personal data transfers under Section 16.

Section 16, DPDP Act 2023