DPDP Statutory & Operational Glossary

The Telecom Disputes Settlement and Appellate Tribunal, which handles appeals against decisions of the Board.

The Data Protection Board of India established under section 18.

Specific scenarios under the Act where a Data Fiduciary may process personal data without explicit consent.

An individual who has not completed the age of eighteen years.

A verifiable digital record of the consent provided by a Data Principal.

A person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent.

The transfer of personal data outside India, which is permitted unless restricted by specific Central Government notifications.

A GDPR term equivalent in concept to a Data Fiduciary in the DPDP Act.

Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.

A visual or tabular representation of how personal data moves through an organizationΓÇÖs systems and to third parties.

A comprehensive record of the personal data an organization collects, processes, stores, and shares.

The practice of collecting only the personal data that is strictly necessary for a specified purpose.

The individual to whom the personal data relates.

A valid contract under which a Data Fiduciary engages a Data Processor to process personal data on its behalf.

Any person who processes personal data on behalf of a Data Fiduciary.

An individual appointed by a Significant Data Fiduciary to represent them and ensure compliance under the Act.

An operational policy defining how long different categories of data are kept and when they are destroyed.

A GDPR term often colloquially used to mean Data Principal, though not officially used in the DPDP Act.

Statutory obligations imposed on individuals, such as the duty not to register false grievances or furnish false particulars.

Specific situations (e.g., state security, law enforcement) where certain provisions of the Act do not apply.

Monetary fines imposed by the Board for significant non-compliance, which can reach up to 250 crore rupees.

An individual appointed by a Data Fiduciary to answer questions and resolve grievances raised by Data Principals.

An entity appointed by a Significant Data Fiduciary to carry out data audits to evaluate compliance with the Act.

Information provided to a Data Principal before or at the time of requesting consent, detailing the data collected and its purpose.

Any data about an individual who is identifiable by or in relation to such data.

Any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data.

A wholly or partly automated operation or set of operations performed on digital personal data.

The principle that data should only be processed for the specific purpose for which consent was obtained.

Technical and organizational measures a Data Fiduciary must implement to protect personal data from breaches.

The right of a Data Principal to obtain a summary of their personal data and processing activities from a Data Fiduciary.

The right of a Data Principal to request correction of inaccurate or misleading personal data.

The right of a Data Principal to request deletion of their personal data when it is no longer necessary for the specified purpose.

The right of a Data Principal to nominate another individual to exercise their rights in the event of death or incapacity.

A Data Fiduciary notified by the Central Government based on data volume, sensitivity, and risk to democracy or public order.

A private limited company, partnership, or LLP recognized under Government notifications, potentially eligible for certain exemptions.

The State as defined under article 12 of the Constitution of India.

The requirement to erase personal data once the specified purpose is fulfilled and retention is no longer necessary.

The process of evaluating the privacy and security posture of third-party Data Processors.

Consent obtained in a manner that can be proven, particularly critical when processing personal data of children.

A formal commitment accepted by the Board from a person facing action, promising to take specified actions to ensure compliance.