DPDP Act 2023 Glossary — Key Terms Explained India

Quick Answer

The DPDP Act 2023 introduces specific legal terms that differ from GDPR equivalents: Data Fiduciary (equivalent to Controller), Data Processor (same as GDPR), Data Principal (equivalent to Data Subject), Consent Manager, and Significant Data Fiduciary. Understanding these definitions is critical because the Act's obligations differ by entity type. This glossary provides plain-language definitions of all key DPDP Act and DPDP Rules 2025 terms.

Quick AnswerDPDP Act 2023 introduces specific defined terms that carry precise legal meanings. Understanding these is essential for correct compliance implementation.

DPDP Compliance Checklist

Data Fiduciary: Any entity that determines the purpose and means of processing personal data
Data Processor: Entity that processes personal data on behalf of a data fiduciary
Data Principal: The individual whose personal data is being processed (replaces 'data subject')
Personal Data: Any data about an identifiable individual — name, email, device ID, location
Consent: Freely given, specific, informed, and unambiguous indication of agreement
Consent Manager: A registered intermediary that enables individuals to manage their consent
Data Protection Board: The regulatory body that adjudicates DPDP complaints and imposes penalties
Significant Data Fiduciary (SDF): A data fiduciary designated by the government due to volume or sensitivity
Grievance Officer: Individual appointed by data fiduciaries to handle data principal complaints
Data Breach: Unauthorised access to, use of, disclosure, disruption, modification, or destruction of personal data

Download Full Compliance Guide (Free)

Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.

Frequently Asked Questions

What is the difference between a data fiduciary and data processor under DPDP?+

A data fiduciary decides WHY and HOW data is processed. A data processor follows the fiduciary's instructions. The fiduciary bears primary DPDP compliance responsibility.

Who is a data principal under DPDP?+

The individual whose personal data is being processed. DPDP deliberately avoids the term 'data subject' used in GDPR, using 'data principal' to reflect the individual's primary rights over their data.

What makes consent valid under DPDP?+

Consent must be freely given (no coercion), specific (for a defined purpose), informed (clear disclosure), and unambiguous (affirmative action — no pre-ticked boxes).

Related DPDP Tools

DPDP Readiness Score Privacy Gap Analysis Vendor Risk Scorecard DPDP Maturity Assessment DPA Generator DPIA Builder

Quick Answer

DPDP glossary terms definitions India — Complete DPDP Compliance Guide

DPDP Compliance Checklist

Download Full Compliance Guide (Free)

Frequently Asked Questions

Related DPDP Tools

Need Expert DPDP Help?

The Sunday DPDP Brief