- Home
- Glossary
Glossary
DPDP glossary
Short definitions of 25 terms from the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, each with the section or rule behind it.
Short answer
The DPDP Act, 2023 sets its key definitions in s.2, and the DPDP Rules, 2025 (G.S.R. 846(E)) add the operating detail. Each entry here gives the short definition first, then where the term appears in the Act and Rules, common misconceptions and related terms. Core obligations for Data Fiduciaries begin on 13 May 2027.
People and roles
Data and processing
Consent and notice
How to read these definitions
Where the Act defines a term in s.2, the entry stays close to its words. For ideas the Act sets out through duties rather than a definition, such as purpose limitation, the entry explains the sections that create the duty. For the definitions in context, see DPDP definitions.
The Act capitalises its defined roles, such as Data Fiduciary, Data Principal and Consent Manager, and so does this glossary. The entries are educational; check how a term applies to your organisation with counsel.
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary decides the purpose and means of processing personal data; a Data Processor processes it on the fiduciary's behalf (s.2). The Data Fiduciary stays responsible for processing done by its processors (s.8).
Does the DPDP Act define sensitive personal data?
No. The Act has a single category of personal data. “Sensitive personal data” comes from the SPDI Rules, 2011 under the IT Act, which continue until s.44(2) of the DPDP Act commences.
Is deemed consent part of the DPDP Act?
No. The 2022 draft Bill had a deemed consent clause; the 2023 Act replaced it with certain legitimate uses in s.7.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin