Section 2: Definitions

Key Statutory Definitions (Section 2)

Section 2 of the Digital Personal Data Protection Act, 2023 defines the central roles and legal concepts governed by Indian privacy law:

1. Data Fiduciary (Section 2(i))

“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.

What this means: If you operate a website, app, or online store and decide what customer data to collect (via forms, analytics, or checkout), your company is legally a Data Fiduciary. This is equivalent to a “Data Controller” under the European GDPR.

2. Data Principal (Section 2(j))

“Data Principal” means the individual to whom the personal data relates and where such individual is—

• (i) a child, includes the parents or lawful guardian of such a child;
• (ii) a person with disability, includes her lawful guardian, acting on her behalf.

What this means: The individual website visitor, customer, subscriber, or user whose data is being collected.

3. Personal Data (Section 2(t))

“personal data” means any data about an individual who is identifiable by or in relation to such data.

What this means: This includes direct identifiers (name, email address, phone number, PAN, Aadhaar) as well as technical identifiers (IP addresses, cookie identifiers, device IDs, advertising tokens) if they can be linked to an identifiable person.

4. Consent Manager (Section 2(g))

“Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.

What this means: An interoperable, registered platform that allows Indian citizens to manage consent across multiple services in one place.

5. Data Processor (Section 2(k))

“Data Processor” means any person who processes personal data on behalf of a Data Fiduciary.

What this means: Cloud providers, hosting companies, CRM platforms, and payment gateways that process data on your company’s instructions.

6. Processing (Section 2(x))

“processing” in relation to personal data means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

What this means: Any action taken on user data, from logging an IP address to storing a database record or passing customer attributes to an analytics tool.

7. Child (Section 2(f))

“child” means an individual who has not completed the age of eighteen years.

What this means: Everyone under 18 is a child. Section 9 then requires verifiable parental consent and bans tracking and targeted ads aimed at them.

8. Personal Data Breach (Section 2(u))

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.

What this means: A breach is wider than a hack. Sending data to the wrong vendor, an accidental leak, or losing access to data through ransomware all count, and all must be reported under Section 8(6).

9. Significant Data Fiduciary (Section 2(z))

“Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.

What this means: A company becomes an SDF only when the government notifies it. SDFs carry extra duties under Section 10.

10. Specified Purpose (Section 2(za))

“specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder.

What this means: Consent covers only the purposes listed in your notice. Using the data for anything else needs fresh consent or a Section 7 legitimate use.

A Note on “She”

Under Section 2(y), “she” refers to an individual of any gender. The Act uses “her” throughout for every Data Principal.

Comparison: DPDP vs GDPR Terminology

Engineering Checklist

• Map out your Data Fiduciary responsibilities: Verify which internal services determine data collection versus external processors (AWS, Stripe, Segment).
• Audit personal data touchpoints: Catalogue all forms, cookies, SDKs, and log files that handle identifiable personal data.
• Establish Data Processor agreements: Ensure written contracts are in place with every vendor processing data on your behalf as mandated by Section 8(2).