This glossary explains the terms used in the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 in plain English. Each definition is short enough to quote and carries the section or rule it comes from, so you can check the source text.
I wrote these the way I explain them in workshops, with an example where it helps. Where a term is defined in the Act, the wording here is a summary and not the legal text. For anything that turns on exact words, read the Act and Rules, and check with counsel.
The roles at a glance
| Role | Decides purpose? | Main source | Typical example |
|---|---|---|---|
| Data Fiduciary | Yes | s.8 | NGO, foundation, startup, company |
| Data Processor | No, acts on instructions | s.8 | Cloud host, CRM vendor, survey agency |
| Data Principal | No, the person the data is about | ss.11 to 15 | Beneficiary, donor, customer, employee |
| Consent Manager | No, a registered intermediary | Rule 4 | Registered consent platform |
| Significant Data Fiduciary | Yes, with extra duties | s.10, Rule 13 | A notified large or high-risk fiduciary |
Roles and bodies
Data Fiduciary. Any person, company, nonprofit or government body that alone or with others decides the purpose and means of processing personal data. The fiduciary carries the main duties under the DPDP Act, including for processing its processors do. A school running an admissions portal is the fiduciary for applicant data.
Data Principal. The individual the personal data relates to. For a child, it includes the parent or lawful guardian, and for a person with disability, the lawful guardian acting on their behalf.
Data Processor. Any person who processes personal data on behalf of a Data Fiduciary, such as a cloud host, CRM vendor or field survey agency. A fiduciary may engage a processor only under a valid contract (s.8).
Consent Manager. A person registered with the Data Protection Board who lets Data Principals give, manage, review and withdraw consent through an accessible, interoperable platform. Registration and obligations sit in Rule 4, in force from 13 November 2026. Consent management software a fiduciary runs for itself, such as the Commons Trust platform, is a different thing.
Significant Data Fiduciary. A Data Fiduciary, or class of them, notified by the Central Government under s.10 based on factors such as data volume and sensitivity, risk to rights, sovereignty, electoral democracy, security and public order. Extra duties apply, covered on /dpdp-for-corporates.
Data Protection Board of India. The body set up under the Act to inquire into breaches, direct remedial measures and impose penalties. Rules 17 to 21 on the Board have been in force since 13 November 2025.
TDSAT. The Telecom Disputes Settlement and Appellate Tribunal, which hears appeals against orders of the Data Protection Board of India under the DPDP Act.
Data Protection Officer (DPO). An individual a Significant Data Fiduciary must appoint under s.10, based in India and responsible to its board or governing body, who is the point of contact for grievances. Other fiduciaries publish a contact person instead.
Independent data auditor. An auditor a Significant Data Fiduciary must appoint under s.10 to evaluate its compliance with the Act. Under Rule 13, SDFs undergo an audit annually alongside their impact assessment.
Data and processing
Personal data. Any data about an individual who is identifiable by or in relation to that data. Names, phone numbers, photos, ID numbers, location and device identifiers linked to a person all qualify.
Digital personal data. Personal data in digital form. Under the DPDP Act this includes data collected digitally and data collected on paper and later digitised, such as a register typed into a spreadsheet.
Processing. Any wholly or partly automated operation on digital personal data, including collection, recording, storage, use, sharing, alignment, combination, restriction, erasure or destruction. Almost anything you do with personal data counts.
Personal data breach. Any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. A misdirected spreadsheet can qualify. Reporting duties are in Rule 7.
Reasonable security safeguards. Measures a fiduciary must take to protect personal data and prevent breaches (s.8). Rule 6 lists examples including encryption, masking, access control, logs and monitoring, backups, log retention for a year and processor contracts.
Grounds, notice and consent
Consent. Agreement by a Data Principal that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to data necessary for the purpose (s.6). It must be as easy to withdraw as to give.
Withdrawal of consent. A Data Principal's right to take back consent at any time, as easily as it was given. The fiduciary and its processors must then stop processing within a reasonable time, unless a law requires retention (s.6).
Legitimate uses. Situations listed in s.7 where personal data can be processed without consent, such as data voluntarily provided for a specified purpose, certain State functions, legal obligations, medical emergencies, disasters and employment purposes.
Notice. The standalone, clear and plain statement a fiduciary gives when seeking consent, itemising the personal data and purpose and explaining how to withdraw consent, exercise rights and complain to the Board (s.5, Rule 3).
Specified purpose. The purpose stated in the notice given to the Data Principal. Consent covers only that purpose, so using the same data for something new generally needs a fresh ground, such as new consent.
Purpose limitation. The practice of using personal data only for the specified purpose and only for as long as it serves that purpose. It runs through ss.5, 6 and 8, including the duty to erase data once the purpose ends.
Eighth Schedule languages. The 22 languages listed in the Eighth Schedule to the Constitution of India. A Data Principal must be able to access the notice in English or any of these languages (s.5, Rule 3).
Children
Child. Anyone under 18 years of age under the DPDP Act. Processing a child's data needs verifiable parental consent and rules out tracking, behavioural monitoring and targeted advertising directed at children (s.9).
Verifiable consent. Consent of a parent or lawful guardian for processing a child's data, given after due diligence that the person is an identifiable adult, using reliable identity or age details or a virtual token such as DigiLocker (s.9, Rule 10).
Fourth Schedule. The schedule to the DPDP Rules listing classes of fiduciaries and purposes exempted from some children's data obligations under Rule 12, such as certain processing by healthcare, educational and child-care providers.
Rights, retention and assessments
Nominee. A person a Data Principal nominates under s.14 to exercise their rights in the event of their death or incapacity. Fiduciaries need a way to record and act on nominations.
Grievance redressal. The mechanism a fiduciary must provide for Data Principals to raise complaints about its processing (ss.8 and 13). Responses must come within the period the fiduciary publishes, which cannot exceed 90 days under Rule 14.
Third Schedule. The schedule to the DPDP Rules setting erasure periods for large classes: e-commerce and social media intermediaries with at least 2 crore registered users in India and online gaming intermediaries with at least 50 lakh. For these, data is erased three years after the person last engaged, with 48 hours' notice (Rule 8).
Data Protection Impact Assessment (DPIA). A structured assessment of how processing affects the rights of Data Principals, its purpose, and the risks and how they are managed. Significant Data Fiduciaries must carry one out periodically, annually under Rule 13.
Using these terms in practice
A glossary helps most when the whole team uses the same words. Agree early which of your activities make you a fiduciary and which make you a processor, and use those labels in contracts, notices and board papers. The DPDP Act guide puts these terms in context, the compliance checklist turns them into tasks, and the penalties page shows what is at stake. Key dates are on the DPDP timeline.
About Commons Trust
Commons Trust is a DPDP compliance programme and consent management platform from commons.inc that takes nonprofits, foundations, startups and corporates from wherever they are to fully compliant with India's Digital Personal Data Protection Act. We work through the full journey or any single stage of it. Questions about any term here can go to hello@commons.inc.
Questions people ask
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides why and how personal data is processed and carries the main legal duties under the DPDP Act. A Data Processor processes data on the fiduciary's behalf and on its instructions, such as a hosting vendor or a survey agency. The fiduciary stays responsible for what its processors do, so it must engage them under a valid contract.
Who is a Data Principal under the DPDP Act?
A Data Principal is the individual whose personal data is being processed. When that individual is a child under 18, the term includes the parent or lawful guardian. For a person with disability, it includes the lawful guardian acting on their behalf. Data Principals hold rights to access, correction, erasure, grievance redressal and nomination under sections 11 to 14.
What is a Consent Manager in the DPDP Act?
A Consent Manager is a person registered with the Data Protection Board of India that gives Data Principals an accessible, interoperable platform to give, manage, review and withdraw consent across fiduciaries. Rule 4 on their registration and obligations comes into force on 13 November 2026. It is different from consent management software a fiduciary runs for its own compliance.
What does verifiable consent mean under DPDP?
Verifiable consent is the consent of a parent or lawful guardian before a child's personal data is processed. Under section 9 and Rule 10, the fiduciary must do due diligence that the person consenting is an identifiable adult, using reliable identity or age details it already holds or a virtual token, for example one issued through DigiLocker.