Section 2 of the DPDP Act is the dictionary for everything after it. Of its 28 definitions, five name the roles that duties attach to, and the rest fix what counts as data, what counts as using it, and which bodies decide disputes. This page gives you the five roles in a line each, then spends its time on the other terms and on how they connect. The wording quoted is the Act's own.
The five roles, one line each
Each role has its own page with the full text, worked examples and the duties that follow.
- Data Fiduciary, Sec. 2(i): the person who alone or with others decides the purpose and means of processing. See Data Fiduciary.
- Data Principal, Sec. 2(j): the individual the data relates to, including a child's parents or lawful guardian. See Data Principal.
- Data Processor, Sec. 2(k): a person who processes personal data on behalf of a Data Fiduciary. See Data Processor.
- Consent Manager, Sec. 2(g): a person registered with the Board who acts as a single point of contact for the Data Principal's consent. See Consent Manager.
- Significant Data Fiduciary, Sec. 2(z): a Data Fiduciary or class of them notified by the Central Government under Sec. 10. See Significant Data Fiduciary.
What counts as data, and what counts as using it
Four definitions set the Act's reach, and each is narrower or broader than people assume.
- Data, Sec. 2(h): a representation of information, facts, concepts, opinions or instructions suitable for communication, interpretation or processing by humans or by automated means.
- Personal data, Sec. 2(t): "any data about an individual who is identifiable by or in relation to such data." Only individuals are covered, and there is no sensitive category. Health, financial and biometric data are all simply personal data.
- Digital personal data, Sec. 2(n): personal data in digital form. Sec. 3(a) brings in data collected on paper and digitised afterwards, which is why a registration desk form that is later keyed in is covered.
- Processing, Sec. 2(x): a wholly or partly automated operation on digital personal data, including collection, storage, use, sharing, restriction and erasure. Because erasure is listed, deleting a record is processing and has to be done lawfully like any other step.
Two more terms carry weight in consent and retention. Specified purpose, Sec. 2(za) is the purpose mentioned in the notice, so consent, the data you may collect and the point at which you must erase are all measured against what the notice said. Personal data breach, Sec. 2(u) covers unauthorised processing and accidental disclosure, alteration, destruction or loss of access that compromises confidentiality, integrity or availability. What a breach triggers is in DPDP data breach notification.
Child and person with disability
Child, Sec. 2(f) means an individual who has not completed eighteen years of age. The line is eighteen. A Data Fiduciary needs verifiable consent of a parent or lawful guardian before processing a child's data (Sec. 9(1)) and may not track or behaviourally monitor children or direct targeted advertising at them (Sec. 9(3)).
Rule 2(1)(d) defines verifiable consent as consent under Rule 10 (parent of a child) or Rule 11 (lawful guardian of a person with disability). Rule 12 and the Fourth Schedule then exempt named classes, such as clinical establishments and educational institutions, and named purposes from Sec. 9(1) and 9(3), within stated conditions. The Act has no separate definition of person with disability, but Rule 11(2)(d) supplies one for the Rules. The Removal of Difficulties Order, 2026 added "of" to Sec. 9(1) so it reads "child or of a person with disability".
Who decides and who hears appeals
Five defined terms describe the enforcement side.
- Board, Sec. 2(c): the Data Protection Board of India, established by the Central Government under Sec. 18. See the Board.
- Chairperson and Member, Sec. 2(e) and 2(q): the Chairperson of the Board, and a Member of the Board including the Chairperson.
- Proceeding, Sec. 2(w): any action taken by the Board under the Act.
- Digital office, Sec. 2(m): an office that adopts an online mechanism under which proceedings, "from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof", are conducted in online or digital mode. Sec. 28(1) has the Board function as one and adopt techno-legal measures as prescribed.
- Appellate Tribunal, Sec. 2(a): the Telecom Disputes Settlement and Appellate Tribunal, established under Sec. 14 of the Telecom Regulatory Authority of India Act, 1997. Appeals against Board orders go there under Sec. 29.
The Rules add "techno-legal measures", which Rule 2(1)(b) defines only by pointing to Rules 20 and 22. Rule 20 has the Board adopt them to conduct proceedings without anyone needing to be physically present. Rule 22 covers appeals to the Appellate Tribunal. The Rules do not define the phrase further.
The Data Protection Officer
Data Protection Officer, Sec. 2(l) is an individual appointed by a Significant Data Fiduciary under Sec. 10(2)(a). The definition is that narrow. An ordinary Data Fiduciary has no duty to appoint a DPO. Sec. 6(3) refers to a DPO "where applicable" and Sec. 8(9) "if applicable", and otherwise to any person authorised to answer Data Principals' questions, whose contact details must be published.
How the terms fit together: who owes what to whom
Read the Act as a set of relationships between the defined roles.
Data Fiduciary to Data Principal. This is where most duties sit: a notice with every consent request (Sec. 5), consent that is free, specific, informed, unconditional and unambiguous (Sec. 6(1)), reasonable security safeguards (Sec. 8(5)), breach intimation (Sec. 8(6)), erasure when the purpose is served (Sec. 8(7)) and a grievance mechanism (Sec. 8(10)). The Data Principal in turn has rights under Sec. 11 to 14 and duties under Sec. 15.
Data Fiduciary to Data Processor. The Fiduciary may engage a Processor for activity related to offering goods or services to Data Principals only under a valid contract (Sec. 8(2)), and stays responsible for the Processor's processing whatever the agreement says (Sec. 8(1)). The Processor's obligations to the Fiduciary come through that contract. See vendor management.
Data Fiduciary to the Board. On a breach the Fiduciary intimates the Board as well as each affected Data Principal (Sec. 8(6)). The Board inquires into complaints and breaches (Sec. 27) and an aggrieved person goes from the Board to the Appellate Tribunal.
Consent Manager to Data Principal. The Consent Manager is accountable to the Data Principal and acts on her behalf (Sec. 6(8)), and sits between her and the Fiduciaries onboarded onto its platform. It must be registered with the Board (Sec. 6(9)).
Government to Significant Data Fiduciary. Status is conferred by notification, not by size. Once notified, the Fiduciary takes on the Sec. 10(2) and Rule 13 duties, including a DPO.
Putting the definitions to work
Start with a mapping exercise. For each processing activity, write down who decides the purpose, who only follows instructions, and whose data it is: the first is a Data Fiduciary, the second a Data Processor, the third a Data Principal. Roles attach to the activity, so a company can be a Fiduciary for its own customers and a Processor for a client. Sec. 2(s) defines "person" to cover individuals, companies, firms, the State and other juristic persons, so nothing in the role definitions depends on turnover or headcount. Whether the Act applies at all is a separate question, answered in does the DPDP Act apply to my organisation.
The processing register holds the inventory of activities, purposes and recipients that makes this mapping repeatable, and the compliance map ties each provision to a control. For the full list of duties, read what is the DPDP Act; for what valid consent must contain, read DPDP consent requirements. One drafting point: Sec. 2(y) says "she" includes an individual irrespective of gender, and the Act uses it throughout.