Every Term the DPDP Act Defines. Verbatim, Not Paraphrased.
Section 2 defines twenty-eight terms and they govern the whole Act: a word used anywhere in the statute carries its section 2 meaning unless the context otherwise requires. Each entry below is the clause as enacted, with a link to the provision it sits in.
Appellate Tribunal
(a) “Appellate Tribunal” means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997;
automated
(b) “automated” means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data;
Board
(c) “Board” means the Data Protection Board of India established by the Central Government under section 18;
Key roles explained →certain legitimate uses
(d) “certain legitimate uses” means the uses referred to in section 7;
Chairperson
(e) “Chairperson” means the Chairperson of the Board;
child
(f) “child” means an individual who has not completed the age of eighteen years;
Children's data under section 9 →Consent Manager
(g) “Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;
Consent Managers under the DPDP Act →data
(h) “data” means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means;
Data Fiduciary
(i) “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
Key roles explained →Data Principal
(j) “Data Principal” means the individual to whom the personal data relates and where such individual is—
Key roles explained →Data Processor
(k) “Data Processor” means any person who processes personal data on behalf of a Data Fiduciary;
Key roles explained →Data Protection Officer
(l) “Data Protection Officer” means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10;
digital office
(m) “digital office” means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode;
digital personal data
(n) “digital personal data” means personal data in digital form;
Overview and scope →gain
(o) “gain” means—
loss
(p) “loss” means—
Member
(q) “Member” means a Member of the Board and includes the Chairperson;
notification
(r) “notification” means a notification published in the Official Gazette and the expressions “notify” and “notified” shall be construed accordingly;
person
(s) “person” includes—
personal data
(t) “personal data” means any data about an individual who is identifiable by or in relation to such data;
Overview and scope →personal data breach
(u) “personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;
Breach reporting under section 8 →prescribed
(v) “prescribed” means prescribed by rules made under this Act;
proceeding
(w) “proceeding” means any action taken by the Board under the provisions of this Act;
processing
(x) “processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction;
Does the Act apply to you? →she
(y) “she” in relation to an individual includes the reference to such individual irrespective of gender;
Significant Data Fiduciary
(z) “Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10;
Significant Data Fiduciary obligations →specified purpose
(za) “specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder; and
State
(zb) “State” means the State as defined under article 12 of the Constitution.
Each definition is reproduced verbatim from the Act as published by MeitY (PDF). Read the clause in place in section 2, or the whole statute in the full-text reader.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against the DPDP Act, 2023 and notified DPDP Rules, 2025. Educational information, not legal advice.
Definitions, answered
Where are the DPDP Act's definitions found?
Section 2 of the Digital Personal Data Protection Act, 2023 defines twenty-eight terms, lettered from clause (a) to clause (zb). They govern the whole Act: a word used anywhere in the statute carries its section 2 meaning unless the context requires otherwise.
What is the difference between a Data Fiduciary and a Data Processor?
A Data Fiduciary determines the purpose and means of processing; a Data Processor only processes on the Fiduciary's behalf. The distinction matters because the Act places its obligations on the Fiduciary, and the Fiduciary remains answerable for what its processor does.
Does the DPDP Act define sensitive personal data?
No. Unlike the SPDI Rules, 2011 and the GDPR, the DPDP Act creates no special category of sensitive personal data. Every item in section 2 treats personal data as a single class, and the only tiering the Act creates is the Significant Data Fiduciary designation under section 10.
Why does the DPDP Act use “she” throughout?
Clause (y) of section 2 provides that “she” and its cognate expressions include a reference to a person of any gender. It is a drafting choice specific to this Act rather than a limitation on who the statute protects.