Rule 2 — Definitions

Section 2 of the Act already defines the twenty-eight terms that carry the whole statute — Data Principal, Data Fiduciary, Data Processor, personal data, and the rest. Rule 2 doesn't repeat any of that. Rule 2(2) says so directly: words used in the Rules but not defined there, and defined in the Act, keep the Act's meaning. What Rule 2(1) adds instead is four terms the Rules specifically need, each one there because a later rule leans on it.

"Act" — Rule 2(1)(a)

A short-form reference to the Digital Personal Data Protection Act, 2023 (22 of 2023). Unremarkable on its own, but it's the anchor every cross-reference in the Rules — "as required under the Act," "her rights under the Act" — points back to.

"Techno-legal measures" — Rule 2(1)(b)

Defined by cross-reference rather than by description: it means whatever Rules 20 and 22 refer to by that phrase. Both of those provisions concern the Board and the Appellate Tribunal functioning as digital offices — conducting proceedings, summoning attendance, and examining evidence without requiring anyone's physical presence. The term exists so the Rules have one label for the digital-office tooling both bodies are permitted to adopt, rather than describing the mechanism twice.

"User account" — Rule 2(1)(c)

The online account a Data Principal registers with a Data Fiduciary, and the definition is written broadly on purpose — it includes any profiles, pages, handles, email address, mobile number, and other similar presences through which that Data Principal can access the Data Fiduciary's services. This term does real work elsewhere: Rule 7's breach-notification duty is discharged by intimating the Data Principal "through her user account or any mode of communication registered by her," and Rule 8's erasure timeline turns on whether she "logs into her user account or otherwise initiates contact." Get this definition wrong and both obligations get harder to apply consistently — a registered mobile number counts as much as a login-protected profile page does.

"Verifiable consent" — Rule 2(1)(d)

Defined entirely by cross-reference: consent as specified in Rule 10 (for a child) or Rule 11 (for a person with disability who has a lawful guardian). The Act's Section 9 requires verifiable consent for both categories; Rule 2 simply names the concept so Rules 10 and 11 can build out its mechanics without redefining the term each time.

Why this matters in practice

Rule 2 looks like the least consequential provision in the whole set — four short entries with no obligation attached to any of them. But "user account" alone determines what counts as valid notification under two separate rules with real deadlines attached, and getting the scope of that definition wrong — treating only a full login profile as a "user account" and ignoring a registered mobile number or email address — is exactly the kind of gap that surfaces during a breach, not during a policy review. Definitions read like formalities right up until an obligation turns on one.

Illustration: a retail app lets customers check out as guests using just a phone number, with no formal account created. If that phone number is "registered" with the platform in the sense Rule 2(1)(c) describes, it likely still counts as a user account for the purposes of Rule 7's breach notice and Rule 8's erasure-warning duty — meaning the absence of a traditional login doesn't excuse the platform from reaching that customer through the channel it does have on file.

How Rule 2 connects to the rest of the Rules and the Act

Rule 2 sits alongside Rule 1 as one of the handful of provisions in force from 13 November 2025 — the Rules need their vocabulary settled before anything else in the set can be applied. Section 2 of the Act remains the primary glossary for every term Rule 2 doesn't touch; Rule 2 only fills in what the Rules add on top. "User account" feeds directly into Rules 7 and 8, and "verifiable consent" is the label Rules 10 and 11 build their entire mechanics around.