Twenty-eight defined terms, and almost every one of them gets reused verbatim in every other section of the Act — get one wrong here and the misreading follows you through the whole statute.
Section 2 doesn't impose any obligation on anyone. It's a glossary. But it's the glossary every other section quotes from, so a definition that looks like throat-clearing is actually where the Act decides who's responsible for what. Read it closely once, and the rest of the Act reads faster — because you're no longer stopping to ask what a term means every time it reappears.
Data Principal — clause (j) — is the individual the data is about. Where that individual is a child, the term automatically extends to their parent or lawful guardian; where they're a person with a disability who has a lawful guardian, it extends to that guardian acting on their behalf. Every right in Chapter III belongs to this person, not to whoever happens to be filling in a form on their behalf.
Data Fiduciary — clause (i) — is whoever decides why and how personal data gets processed, alone or together with others. This is deliberately a functional test, not a label you can opt out of by calling yourself something else: if you're the one deciding purpose and means, you're a Data Fiduciary regardless of what your contract says you are.
Data Processor — clause (k) — is anyone processing personal data on a Data Fiduciary's behalf, under its instructions. A processor doesn't decide why the data is being processed; it just carries out what the Fiduciary tells it to. That distinction is the one most vendor arrangements get wrong, because "processor" sounds like a lesser role — but it's a role defined by lack of control, not lack of importance.
Personal data — clause (t) — is any data about an individual who is identifiable by or in relation to it. Digital personal data — clause (n) — is personal data in digital form. Section 3 uses exactly this pair to draw the boundary of what the Act covers at all — data collected digitally, or collected offline and digitised afterwards.
Processing — clause (x) — is defined broadly on purpose: any wholly or partly automated operation on digital personal data, and the Act lists collection, recording, storage, use, sharing, disclosure, and erasure as examples, not an exhaustive set. If an operation touches digital personal data in any way, it's processing under this Act — there's no small enough action that falls outside the definition.
Consent Manager — clause (g) — is a person registered with the Board who acts as a single point of contact letting a Data Principal give, manage, review and withdraw consent through one accessible, interoperable platform. It's a specific registered role, not a generic label for any consent-management software — a platform your organisation builds for its own consent capture doesn't make you a Consent Manager under this definition.
Data Protection Officer — clause (l) — is the individual a Significant Data Fiduciary appoints under Section 10(2)(a). The definition only exists in relation to that specific obligation; a general "privacy lead" job title elsewhere in a company isn't automatically a DPO in the Act's sense.
Significant Data Fiduciary — clause (z) — is any Data Fiduciary or class of Data Fiduciaries the Central Government notifies under Section 10. It's a status assigned from outside, not one an organisation claims or avoids by self-assessment.
Personal data breach — clause (u) — is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. Note how wide this is: an accidental internal disclosure with no external attacker involved still qualifies, which is what makes Section 8(6)'s breach-notification duty trigger more often than "breach" tends to suggest in ordinary usage.
Child — clause (f) — is anyone who hasn't completed eighteen years, a flat line with no case-by-case judgement built in. Person — clause (s) — is deliberately expansive: individuals, Hindu undivided families, companies, firms, associations, the State, and any other artificial juristic person. And clause (y) clarifies that "she," used throughout the Act for the Data Principal, is gender-neutral drafting — it refers to the individual regardless of gender, not a statement about who the Act is imagining.
Almost every dispute about DPDPA obligations eventually turns on which of these definitions actually applies to a given arrangement. Whether your organisation is a Data Fiduciary or a Data Processor for a specific data flow decides who owes notice under Section 5, who owes breach intimation under Section 8(6), and who a regulator would actually investigate first. Getting that classification wrong at the contract stage is a mistake that surfaces months later, usually during an incident — not something you want to be working out for the first time when the Board is asking questions.
Illustration: a company running its own e-commerce platform is the Data Fiduciary for its customers' order data. The cloud host storing that data, and the courier company delivering the order, are Data Processors — they act on the company's instructions and don't decide why the data is collected. If the courier's app leaks delivery addresses, the company is still the party the Board holds accountable under Section 8(1), even though the courier caused the breach.
Section 3 immediately uses "personal data" and "digital personal data" to set the Act's territorial and material reach. Section 7's "certain legitimate uses" is only a cross-reference here (clause (d)) — the actual list lives in Section 7 itself. Section 8 assigns its eleven general obligations to whoever meets the Data Fiduciary definition, and Section 10 layers extra obligations on top once the Significant Data Fiduciary notification applies. Rule 2 of the DPDP Rules, 2025 adds a handful of further definitions the Rules need on top of these.
30 minutes to walk through your actual arrangement — no obligation.
Book a Consultation