DPDP Act glossary: privacy terms explained
Plain-language explanations of Indian data protection law and privacy practice. Distinguish statutory duties, foreign-law concepts and practical recommendations.
Certain legitimate uses
Certain legitimate uses are specific situations in Section 7 where processing may proceed without relying on Section 6 consent.
Data Protection Officer (DPO)
A Data Protection Officer is the India-based accountability contact required for a notified Significant Data Fiduciary.
Sub-Processor
A sub-processor is a supplier engaged by another processor to process personal data on a fiduciary's behalf.
Verifiable Parental Consent (VPC)
Verifiable parental consent checks that the person consenting to a child's data processing is an identifiable adult parent, subject to applicable exceptions.
National Security Exemption
The national-security exemption depends on a Central Government notification covering a State instrumentality and specified statutory grounds.
Personal Data Breach
A personal data breach compromises confidentiality, integrity or availability through unauthorised processing, disclosure, alteration, destruction or loss of access.
Cross-Border Data Transfer
Cross-border transfer involves processing or making personal data available outside India, including through overseas suppliers.
Data portability
Data portability means obtaining and moving reusable data between services; it is not a standalone right under India's DPDP Act.
Dual-Clock Breach Notification
Breach notification informs affected individuals and the Data Protection Board about a personal data breach.
Deemed consent (historical term)
Deemed consent is historical drafting terminology; the enacted DPDP Act instead uses certain legitimate uses in Section 7.
Research, Archival & Statistical Exemption
The research exemption covers necessary research, archiving or statistical processing subject to conditions and prescribed standards.
Grievance Redressal Officer
A grievance contact enables individuals to raise processing concerns and use the available redressal mechanism.
Lawful Basis for Processing
DPDP processing requires a lawful purpose and either consent or an applicable certain legitimate use in Section 7.
Sensitive personal data
Sensitive personal data describes information whose misuse may cause greater harm; DPDP does not create a separate sensitive-data category.
Data Fiduciary Obligations
Fiduciary obligations address notice, processing grounds, security, specified accuracy duties, erasure, breach reporting and individual rights.
DSR Response Timeline
DPDP does not impose one universal 30-day or 90-day deadline for every access, correction and erasure request.
Purpose Limitation
Purpose limitation keeps processing tied to the lawful, specified purpose for which data is collected or otherwise permitted.
Record of Processing Activities (RoPA)
A record of processing activities inventories purposes, data categories, recipients, systems and retention decisions.
Anonymised data
Anonymised data no longer identifies an individual by or in relation to the data, considering realistic re-identification possibilities.
Storage Limitation
Storage limitation means retaining personal data only while a permitted purpose or legal retention requirement justifies keeping it.
Processing of Personal Data
Processing includes operations on digital personal data such as collection, storage, use, sharing, restriction, erasure and destruction.
Right to correction
The right to correction concerns correcting, completing or updating personal data covered by Section 12.
Children's Personal Data
A child under DPDP is an individual under 18, whose personal data receives additional protections.
Data Flow Mapping
Data flow mapping shows movement of personal data between people, applications, stores, suppliers and locations.
Itemised Privacy Notice
A privacy notice explains personal data, specified purposes and how individuals can exercise relevant choices and rights.
Pseudonymous data
Pseudonymous data replaces direct identifiers with codes while additional information can reconnect records to people.
Right to erasure
The right to erasure allows deletion requests for personal data covered by Section 12, subject to purpose and legal-retention exceptions.
Right to Nominate
The right to nominate allows another person to exercise DPDP rights after the individual's death or incapacity.
Right to withdraw consent
An individual can withdraw consent at any time with ease comparable to the way it was given.
DPB Complaint Process
Eligible complaints reach the Data Protection Board under its statutory powers and procedures.
Accuracy Obligation
The accuracy obligation concerns reasonable efforts toward completeness, accuracy and consistency in the situations specified by Section 8(3).
Data Minimisation
Data minimisation limits personal data to what is needed for the specified purpose.
Data Subject Request (DSR / DPR)
A data subject request is common privacy terminology; DPDP refers to Data Principals and their specific statutory rights.
Right to Grievance Redressal
Grievance redressal provides an accessible mechanism for concerns about a fiduciary's or Consent Manager's DPDP obligations.
Vulnerability Assessment & Penetration Testing (VAPT)
A vulnerability assessment identifies weaknesses that could expose personal data.
Independent Data Audit
Notified Significant Data Fiduciaries must meet additional audit duties, including an independent data auditor and periodic assessments.
Personal Data
Personal data is information about an individual identifiable by or in relation to that data.
Data Principal
A Data Principal is the individual to whom personal data relates, including specified representative arrangements.
Erasure & Deletion Obligation
Deletion obligations require erasure when statutory conditions are met and relevant action by processors.
PII Classification & Discovery
PII classification groups identifiers and other personal data to support appropriate controls.
Data Retention Policy
A retention policy states how long information is kept, the justification and the event triggering review or deletion.
Adjudicating officer and the DPDP Board
DPDP assigns relevant inquiries and monetary-penalty decisions to the Board, not a separate office named DPDP Adjudication Officer.
Profiling & Behavioral Monitoring
Profiling analyses personal data to infer or evaluate characteristics such as interests, behaviour or risk.
Right to Access
The right to access information concerns a summary of personal data and processing and specified information about recipients.
Automated Decision Making (ADM)
Automated decision-making uses systems to reach or support decisions; DPDP does not reproduce GDPR's standalone automated-decision right.
Data Processor
A Data Processor processes personal data on behalf of a Data Fiduciary.
Data Protection Agreement (DPA)
A data protection or processing agreement records responsibilities for processing personal data on another organisation's behalf.
Privacy by Default
Privacy by default limits unnecessary collection, access and disclosure through the service's initial settings.
Access Control & Least Privilege
Access control limits who and what can read, change or disclose personal data.
Data Protection Board of India (DPB)
The Data Protection Board of India is the body established for the Act's specified statutory functions.
Encryption at Rest
Encryption at rest makes stored information unreadable without appropriate cryptographic keys.
Encryption in Transit
Encryption in transit protects information while it travels between systems and users.
Consent Manager
A Consent Manager is registered with the Board to enable individuals to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
Data Fiduciary
A Data Fiduciary determines the purposes and means of processing personal data, alone or jointly.
Data Protection Impact Assessment (DPIA)
A DPIA assesses processing, risks to individuals and measures to manage those risks.
Digital Personal Data
Digital personal data is personal data in digital form.
Privacy by Design
Privacy by design considers data protection during planning and development.
State Processing Exemption
State processing grounds and exemptions have specific conditions; there is no blanket exclusion for all government processing.
Explicit Consent
DPDP consent must be free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action for a specified purpose.
Journalistic exemption
The enacted DPDP Act contains no general journalism exemption equivalent to exemptions in some foreign privacy laws.
Reasonable Security Safeguards
Reasonable security safeguards protect personal data against breach through controls appropriate to processing and risk.
Significant Data Fiduciary (SDF)
An SDF is a fiduciary or class of fiduciaries notified by the Central Government using statutory risk factors.
Special Category & Sensitive Data
Special-category data is GDPR terminology, not a separate statutory category created by DPDP.
DPDPA Penalty Schedule
The DPDP Schedule sets maximum monetary penalties for specified contraventions, not automatic fines for every incident.
Data Localisation
Data localisation refers to requirements to keep specified data or processing within a territory.
Consent Management
Consent management presents information, records choices and enforces changes or withdrawal across processing systems.
Incident Response Plan (IRP)
An incident response plan assigns roles for detecting, containing, investigating and communicating incidents.
System of Records (SoR)
A system of record is the designated authoritative source for a type of information.