Section 2
DPDP definitions for Indian teams
The definitions in s.2 decide who carries which duty. Here are the terms teams use most, in close paraphrase, each linked to its glossary page.
Short answer
Section 2 of the DPDP Act defines its key terms. A Data Fiduciary decides the purpose and means of processing personal data, a Data Principal is the individual the data relates to, and a Data Processor processes data on a fiduciary's behalf. A child is an individual who has not completed eighteen years of age, and the Act does not define “sensitive personal data”.
The people and bodies the Act names
| Term | Meaning (s.2, close paraphrase) | Glossary |
|---|---|---|
| Data Fiduciary | Any person who alone or with others determines the purpose and means of processing personal data. | Data Fiduciary |
| Data Principal | The individual the personal data relates to. For a child, it includes the parents or lawful guardian; for a person with disability, it includes the lawful guardian acting on their behalf. | Data Principal |
| Data Processor | Any person who processes personal data on behalf of a Data Fiduciary. | Data Processor |
| Consent Manager | A person registered with the Board who acts as a single point of contact to let a Data Principal give, manage, review and withdraw consent through an accessible, transparent and interoperable platform. | Consent Manager |
| Significant Data Fiduciary | A Data Fiduciary or class of Data Fiduciaries notified by the Central Government under s.10. | Significant Data Fiduciary |
| Board | The Data Protection Board of India established under s.18. | Data Protection Board |
| Child | An individual who has not completed eighteen years of age. | Child |
The data and what you do with it
| Term | Meaning (s.2, close paraphrase) | Read more |
|---|---|---|
| Personal data | Any data about an individual who is identifiable by or in relation to such data. | Personal data |
| Digital personal data | Personal data in digital form. | Digital personal data |
| Processing | A wholly or partly automated operation or set of operations on digital personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction. | Processing |
| Personal data breach | Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. | Rule 7 breach duties |
The definition of processing includes storage, restriction and erasure. Simply keeping personal data in a system is processing, so the Act's duties apply to it.
Terms the Act does not use
- Deemed consent: not a concept in the enacted Act. The 2022 draft Bill had a “deemed consent” clause; the 2023 Act replaced it with “certain legitimate uses” (s.7). See deemed consent.
- Sensitive personal data: the Act does not define it; the SPDI Rules, 2011 did. The sensitivity of data is one factor the Central Government weighs when notifying a Significant Data Fiduciary (s.10).
- Legitimate interest: there is no such ground. Processing needs consent (s.6) or a legitimate use under s.7, as s.4 sets out.
Other terms used across the Act
| Term | Where it comes from | Glossary |
|---|---|---|
| Consent | Free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6) | Consent |
| Notice | Accompanies every consent request (s.5, Rule 3) | Notice |
| Verifiable consent | Consent of a parent or lawful guardian (s.9(1), Rules 10 and 11) | Verifiable consent |
| Purpose limitation | Consent is limited to the personal data necessary for the specified purpose (s.6) | Purpose limitation |
| Data Principal rights | Access, correction and erasure, grievance redressal, nomination (s.11 to s.14) | Data Principal rights |
| Erasure and correction | Rights under s.12; the erasure duty in s.8(7) | Erasure, correction |
| Nomination | Right to nominate under s.14 | Nomination |
| Grievance redressal | Duty in s.8(10); right in s.13 | Grievance redressal |
| Data Protection Officer | Appointed by a Significant Data Fiduciary and based in India (s.10(2)(a)) | Data Protection Officer |
| Independent data auditor | Appointed by a Significant Data Fiduciary (s.10(2)(b)) | Data auditor |
| Cross-border transfer | Transfers can be restricted to countries the Central Government notifies (s.16) | Cross-border transfer |
| Retention | Erase when the purpose is no longer served (s.8(7), Rule 8) | Retention |
How TruePrivacy helps
Definitions matter most when you assign roles. In TruePrivacy, records of processing list each processing activity, synced from discovery, and vendors and processors record the outside parties that act as Data Processors, with contract (DPA) tracking.
Data classification shows the kinds of personal data your scans found, where each sits and how many records hold it, so “personal data” in your records means what is actually in your systems.
Is a Data Processor the same as a Data Fiduciary?
No. A Data Fiduciary decides the purpose and means of processing; a Data Processor processes personal data on its behalf (s.2). The fiduciary stays responsible for processing done by its processors (s.8(1)).
Who is a child under the DPDP Act?
An individual who has not completed eighteen years of age (s.2).
Does the DPDP Act define sensitive personal data?
No. The SPDI Rules, 2011 defined it, but the DPDP Act does not create categories of sensitive personal data.
What is deemed consent under DPDP?
Deemed consent is not a concept in the enacted Act. The 2022 draft Bill had it; the 2023 Act replaced it with certain legitimate uses in s.7.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin