Definitions
'Data Principal' means the individual to whom the personal data relates and where such individual is a child, includes the parents or lawful guardian of such child; and where such individual is a person with disability, includes her lawful guardian, acting on her behalf.
'Data Fiduciary' means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
'Data Processor' means any person who processes personal data on behalf of a Data Fiduciary.
'Personal data' means any data about an individual who is identifiable by or in relation to such data.
'Processing' in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
'Consent Manager' means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
'Significant Data Fiduciary' means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.
'Board' means the Data Protection Board of India established under section 18.
- These definitions decide who owes duties to whom. 'Data Fiduciary' is the party that decides why and how personal data is processed — in most other frameworks this role is closer to a 'controller'.
- 'Data Processor' is a vendor acting on the Fiduciary's instructions — comparable to a 'processor' elsewhere, but under DPDP the Processor itself owes no direct statutory duty to the Data Principal; liability flows through the Fiduciary via contract.
- 'Personal data' is deliberately broad — any data that can identify an individual, regardless of sensitivity category. DPDP does not create separate tiers for 'sensitive' personal data the way some other laws do.
- A 'Consent Manager' is a DPDP-specific role: a registered intermediary that lets an individual manage consent across multiple Fiduciaries from one dashboard.
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.