DPDP glossary
The Act uses a handful of words in a precise way. Each term below is explained in plain language, with what the law itself says where it matters.
B
- Breach notification
- Telling the Board and affected people about a personal data breach.
C
- Child
- A young person whose data needs a parent's consent.
- Consent
- A person's clear yes to a specific use of their data.
- Consent Manager
- A registered service that lets people give, manage and withdraw consent in one place.
- Cross-border transfer
- Sending personal data to a country outside India.
D
- Data audit
- An independent check of how a business handles personal data.
- Data Fiduciary
- The business or person that decides why and how personal data is processed.
- Data minimisation
- Collecting only the data you need for the stated purpose.
- Data Principal
- The person the personal data is about.
- Data Processor
- A vendor that processes personal data on a business's behalf.
- Data Protection Board of India
- The body that enforces the Act.
- Data Protection Impact Assessment
- A structured review of the risks a type of processing creates for people.
- Data Protection Officer
- The named person who answers for a Significant Data Fiduciary's compliance.
- Data retention
- How long a business keeps personal data.
- Digital personal data
- Personal data in digital form, or paper data later digitised.
- DPDP Act
- India's Digital Personal Data Protection Act, 2023.
- DPDP Rules, 2025
- The rules that put the Act into practice.
- Duties of a Data Principal
- What the Act expects from people, not just businesses.
G
- Grievance redressal
- How a person complains to a business about their data, and gets an answer.
L
- Legitimate uses
- Situations where personal data can be processed without consent.
N
- Notice
- The plain-language explanation a business gives before asking for consent.
P
- Penalty
- The amount the Board can order a business to pay for breaking the Act.
- Personal data
- Any data about a person who can be identified from it.
- Personal data breach
- Any unauthorised processing, loss or exposure of personal data.
- Privacy notice
- The public page that explains how a website or business uses personal data.
- Processing
- Anything done with personal data, from collecting it to deleting it.
- Purpose limitation
- Using personal data only for the purpose it was collected for.
R
- Reasonable security safeguards
- The protections a business must put around personal data.
- Right to access
- A person's right to know what data a business holds about them.
- Right to correction and erasure
- A person's right to fix or remove their data.
- Right to nominate
- Choosing someone to use your data rights if you cannot.
S
- Significant Data Fiduciary
- A business the Government names for extra duties because of the volume or risk of its processing.
V
- Verifiable parental consent
- Confirming that the person consenting for a child really is their parent.
W
- Withdrawal of consent
- A person taking back consent they gave earlier.
Plain-language explanation, not legal advice.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.