Knowledge Resources › Key Definitions
Last updated: 20 August 2026
India’s Digital Personal Data Protection Act, 2023 uses a set of defined terms throughout. Understanding these makes the rest of the framework much easier to follow. The explanations below are in plain language; the Act itself contains the precise definitions.
The people and entities
- Data Principal — the individual to whom the personal data relates. Where the individual is a child, the term includes the parent or lawful guardian; where the individual is a person with a disability, it includes their lawful guardian.
- Data Fiduciary — a person who, alone or with others, determines the purpose and means of processing personal data. This is the organisation that decides why and how the data is used.
- Data Processor — a person who processes personal data on behalf of a Data Fiduciary, under a contract with it.
- Significant Data Fiduciary — a Data Fiduciary (or class of them) notified by the Government as significant, based on factors such as the volume and sensitivity of data processed and risks to individuals. It carries additional obligations.
- Consent Manager — a registered entity that provides an accessible, transparent and interoperable platform through which a Data Principal can give, manage, review and withdraw consent.
- Data Protection Board of India — the body established under the Act to oversee compliance and to inquire into breaches and complaints.
The data and the activity
- Personal data — any data about an individual who is identifiable by or in relation to such data.
- Processing — a wholly or partly automated operation (or set of operations) performed on digital personal data, such as collection, storage, use, sharing, disclosure or erasure.
- Personal data breach — any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
These terms recur across the Act’s obligations and rights. For how the framework comes into force, see the note on the phased implementation timeline. This page is for general information only and is not legal advice.