What is a Data Fiduciary under DPDPA 2023?

A Data Fiduciary is any person who alone or jointly with others determines the purpose and means of processing personal data (§2(i), DPDPA 2023). Any Indian business that collects, uses, or processes personal data of Indian individuals is a Data Fiduciary.

What is the difference between a Data Fiduciary and a Data Processor?

A Data Fiduciary determines why and how personal data is processed. A Data Processor processes data on the Fiduciary's behalf, under contract, and only as instructed (§2(k), DPDPA 2023). For example, a company is the Data Fiduciary; its payroll software vendor is a Data Processor.

What is a Significant Data Fiduciary?

A Significant Data Fiduciary (SDF) is a Data Fiduciary designated by the Central Government based on the volume and sensitivity of data processed, risk to Data Principals, security risk, and potential impact on sovereignty (§10, DPDPA 2023). SDFs have additional obligations: appointing a DPO, conducting DPIAs, maintaining RoPA, and annual audits.

What is a Consent Manager under DPDPA?

A Consent Manager is a registered intermediary through which Data Principals can give, manage, review, and withdraw consent to multiple Data Fiduciaries through a single platform (§2(g), Rule 4, DPDPA 2023). Consent Managers must register with the Data Protection Board and meet financial and technical requirements.

What is a Record of Processing Activities (RoPA)?

A Record of Processing Activities (RoPA) is a comprehensive documentation of all personal data processing activities within an organisation. It covers data categories, purposes, legal basis, retention periods, third-party sharing, and security measures. RoPA is mandatory for Significant Data Fiduciaries under Rule 12, DPDPA 2023, and is best practice for all Data Fiduciaries.

DPDPA 2023 Glossary

70+ terms from India's Digital Personal Data Protection Act and Rules — in plain English, with real examples.

DPDPA Act 2023DPDP Rules 202570 TermsUpdated May 2026

Data Fiduciary

Core Concepts

Any person or organisation that determines the purpose and means of processing personal data.

§2(i), DPDPA 2023

Data Principal

Core Concepts

The individual whose personal data is being collected, stored, or processed by a Data Fiduciary.

§2(j), DPDPA 2023

Data Processor

Core Concepts

Any person or entity that processes personal data on behalf of a Data Fiduciary under contract.

§2(k), DPDPA 2023

Personal Data

Core Concepts

Any data about an individual who is identifiable by or in relation to such data.

§2(t), DPDPA 2023

Digital Personal Data

Core Concepts

Personal data that exists in digital form, whether collected digitally or digitised from non-digital sources.

§2(n), DPDPA 2023

Sensitive Personal Data

Core Concepts

Categories of personal data requiring enhanced protection due to their intimate or consequential nature.

§3(n), DPDPA 2023

Special Category Data

Core Concepts

Data revealing racial origin, political opinions, religious beliefs, health, sexual orientation, or biometrics.

§3(n), DPDPA 2023; Rule 6, Rules 2025

Anonymised Data

Core Concepts

Personal data irreversibly transformed so that the individual cannot be identified by any means whatsoever.

§2(b), DPDPA 2023

Pseudonymous Data

Core Concepts

Personal data processed so identification requires additional separately-held information, but remains reversible.

§2(t), DPDPA 2023; Rule 6(1), Rules 2025

Processing of Personal Data

Core Concepts

Any operation performed on digital personal data including collection, storage, use, sharing, or erasure.

§2(x), DPDPA 2023

Data Breach

Core Concepts

Any unauthorised processing, accidental disclosure, acquisition, sharing, or loss of personal data.

§8(6), DPDPA 2023; Rule 7, Rules 2025

Cross-Border Data Transfer

Core Concepts

Transfer of personal data from India to another country, permitted unless the destination is specifically restricted.

§16, DPDPA 2023

Automated Decision-Making

Core Concepts

Decisions made about individuals solely by automated means without meaningful human involvement in the process.

§2(x), DPDPA 2023; Rule 6(1)(b), Rules 2025

Profiling

Core Concepts

Automated processing of personal data to evaluate, analyse, or predict individual behaviour or characteristics.

§2(x), DPDPA 2023; Rule 6(1), Rules 2025

Children's Data

Core Concepts

Personal data of any individual below 18 years of age, requiring verifiable parental consent for processing.

§9, DPDPA 2023; Rule 10, Rules 2025

DPDPA 2023 Glossary

Data Fiduciary

Data Principal

Data Processor

Personal Data

Digital Personal Data

Sensitive Personal Data

Special Category Data

Anonymised Data

Pseudonymous Data

Processing of Personal Data

Data Breach

Cross-Border Data Transfer

Automated Decision-Making

Profiling

Children's Data

Consent Management

Privacy Notice

Purpose Limitation

Data Minimisation

Storage Limitation

Accuracy Obligation

Breach Notification

Data Protection Impact Assessment (DPIA)

Record of Processing Activities (RoPA)

Privacy by Design

Privacy by Default

Data Protection Agreement (DPA)

Sub-Processor

Retention Policy

Deletion Obligation

Right to Access

Right to Correction

Right to Erasure

Right to Grievance Redressal

Right to Nominate

Data Portability

Right to Withdraw Consent

Data Subject Request (DSR)

DSR Response Timeline

Right to Information About Processing

Data Protection Board of India (DPB)

Data Protection Officer (DPO)

Significant Data Fiduciary (SDF)

Consent Manager

Grievance Officer

Adjudication Officer

DPB Complaint Process

DPDPA Penalty Schedule

Data Fiduciary Obligations

Audit Requirement

PII Classification

Encryption at Rest

Encryption in Transit

Access Control

Data Localisation

Security Safeguards

Vulnerability Assessment

Incident Response Plan

Data Flow Mapping

System of Records

Lawful Basis for Processing

Legitimate Use

State Processing Exemption

Research Exemption

Journalistic Exemption

National Security Exemption

Deemed Consent

Voluntary Consent

Explicit Consent

Verifiable Parental Consent