Glossary
What is processing under DPDP?
Processing covers almost every automated operation on digital personal data, from collection and storage to sharing and erasure.
Definition
Under s.2 of the DPDP Act, 2023, processing is a wholly or partly automated operation or set of operations on digital personal data, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction. Collection, storage, sharing and erasure are all processing.
What it means
If a system touches digital personal data in an automated way, it is very likely processing. Erasure and destruction are in the list too, so the Act's duties cover the end of the data's life as well as the start.
Processing needs a lawful purpose and a ground: consent or a legitimate use (s.4). The Data Fiduciary is responsible for it, including processing by its Data Processors (s.8).
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines processing |
| s.3 | Applies to processing of digital personal data in India, and outside India when connected with offering goods or services in India |
| s.4 | A lawful purpose, with consent or for a legitimate use |
| s.8 | The Data Fiduciary is responsible for processing, including by its processors |
| Rule 8(3) | Logs of processing kept for at least one year for Seventh Schedule purposes |
Common misconceptions
- “Storing data is not processing.” Storage is in the s.2 definition.
- “Every handling of a paper file is processing under DPDP.” The definition covers wholly or partly automated operations on digital personal data. Paper records come in once digitised (s.3).
- “Erasure is outside the Act.” Erasure and destruction are listed operations.
Related terms
Personal data in digital form, the Act's scope (s.2, s.3).
Data FiduciaryDecides the purpose and means of processing personal data (s.2).
Data ProcessorProcesses personal data on behalf of a Data Fiduciary (s.2).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
In TruePrivacy
Records of processing list your processing activities and data map, synced from discovery and exportable. Data discovery finds where personal data sits, so the record reflects your real systems. See the record-keeping guide.
Is storing data processing under DPDP?
Yes. Storage is one of the operations listed in the s.2 definition of processing.
Does processing cover paper records?
The definition covers operations on digital personal data. Paper records come in once digitised (s.3).
Who is responsible for processing done by a vendor?
The Data Fiduciary (s.8). It must engage the vendor under a valid contract (s.8(2)).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin