Foundations
DPDP Glossary
Plain-language definitions of the key terms in India's Digital Personal Data Protection Act — Data Fiduciary, Data Principal, Consent Manager and more. One short page per term, in language anyone can follow.
What is a Data Fiduciary?A Data Fiduciary is the person or organisation that decides why and how your personal data is processed — and carries the duties under India's DPDP Act.What is a Data Principal?A Data Principal is the individual the personal data is about — the person India's DPDP Act gives rights to, including the right to give and withdraw consent.What is a Consent Manager?A Consent Manager is a Data Protection Board–registered platform that lets you give, manage, and withdraw consent across services from one place under the DPDP Act.What is a Data Processor?A Data Processor is a person or company that processes personal data on behalf of a Data Fiduciary, on its instructions — not for its own purposes — under India's DPDP Act.What is a Significant Data Fiduciary?A Significant Data Fiduciary is a higher-risk business the government designates under the DPDP Act, carrying extra duties like an India-based DPO, audits, and annual impact assessments.What is legitimate use under DPDP?Legitimate use is a closed list of situations under Section 7 of India's DPDP Act where personal data can be processed without consent — like employment.What are Data Principal rights?Data Principal rights are the rights India's DPDP Act gives every individual over their personal data — access, correction, erasure, grievance redressal, nomination, and withdrawing consent.What is a DPDP notice?A DPDP notice is the plain-language statement a business must give at or before collecting your personal data — what it's taking, why, and your rights.What is purpose limitation?Purpose limitation means personal data may be used only for the specific purpose it was collected and consented for — a core principle of India's DPDP Act.What is a personal data breach (DPDP)?Under India's DPDP Act, a personal data breach is any unauthorised processing, or accidental disclosure, loss, or alteration of personal data that compromises its confidentiality, integrity, or availability.What is a Data Protection Officer (DPO)?A Data Protection Officer (DPO) is the India-based person a Significant Data Fiduciary must appoint under the DPDP Act to lead data-protection compliance and answer to the Board.What is data minimisation?Data minimisation means collecting only the personal data you genuinely need for a stated purpose — nothing extra — a core principle under India's DPDP Act.What is the Data Protection Board of India?The Data Protection Board of India is the regulator set up under the DPDP Act to investigate data-protection complaints, direct remedial action, and impose penalties.What is the right to withdraw consent?Under India's DPDP Act, you can take back consent to the use of your personal data at any time — and it must be as easy to withdraw as it was to give.