BLOG POST · TRAYAMBIC
The DPDP Act in 15 Terms: A Plain-Language Glossary
Fifteen of the 28 definitions in section 2 of the DPDP Act decide whether your data is covered, who carries the duty and what counts as a breach.
DEFINITIONSAS OF OCTOBER 20264 MIN READ
ALL BLOGS
- CATEGORY
- Blog post · Definitions
- POSITION AS OF
- October 2026
- READING TIME
- 4 min read
- TAGS
- DPDP Act, Definitions, Data fiduciary, Personal data, Compliance basics
Section 2 of the Digital Personal Data Protection Act, 2023 (the DPDP Act) defines 28 terms. Fifteen of them settle the first questions a business asks: is this data covered, who owes the duty, and what counts as going wrong. Section 2 has been in force since 13 November 2025, although most duties that use these words commence on 13 May 2027.
Three reading habits
- "Means" and "includes". Most clauses say "means" and, in our view, give the whole meaning. "Person" says "includes", which usually widens a word's ordinary meaning, though the Supreme Court has said context decides.
- Context. Every definition applies "unless the context otherwise requires".
- "She". The Act calls every individual "she"; clause (y) says this covers an individual "irrespective of gender".
Who is who
| Term and clause | The Act's words | Why it matters |
|---|---|---|
| Person, s.2(s) | Includes an individual, a company, a firm, "an association of persons or a body of individuals, whether incorporated or not" and "the State" | A residents' association, a club or a government department can be a data fiduciary. |
| Data fiduciary, s.2(i) | "any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data" | Almost every duty sits here. The role follows facts, not contract labels, and can be shared. |
| Data processor, s.2(k) | "any person who processes personal data on behalf of a Data Fiduciary" | The fiduciary answers for its processors (s.8(1)). Trayambic's article for processors covers the vendor's side. |
| Significant Data Fiduciary, s.2(z) | "any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10" | Status comes from notification, not self-assessment. None has been notified; designation brings a DPO, audits and DPIAs. |
| Data principal, s.2(j) | "the individual to whom the personal data relates"; for a child it "includes the parents or lawful guardian", and for a person with disability, her lawful guardian | Parents and guardians receive notices and exercise rights. |
| Child, s.2(f) | "an individual who has not completed the age of eighteen years" | The line is 18, not 13 or 16. Section 9 requires verifiable parental consent and bars tracking and targeted advertising. |
| Consent manager, s.2(g) | "a person registered with the Board" acting as "a single point of contact" to give, manage, review and withdraw consent | Registration opens with Rule 4 on 13 November 2026. Trayambic's Insight on consent managers explains the model. |
| Board, s.2(c) | "the Data Protection Board of India established by the Central Government under section 18" | It hears complaints and imposes penalties, but a Lok Sabha answer of August 2026 reported no members appointed. |
What is covered, and on what basis
| Term and clause | The Act's words | Why it matters |
|---|---|---|
| Personal data, s.2(t) | "any data about an individual who is identifiable by or in relation to such data" | Health or financial data gets no special label. "Data" includes "opinions" (s.2(h)), so in our view ratings and inferences count. Data that cannot be re-linked to anyone is outside. |
| Digital personal data, s.2(n) | "personal data in digital form" | Paper is outside until "digitised subsequently" (s.3(a)); scanning a form brings it in. |
| Processing, s.2(x) | "a wholly or partly automated operation or set of operations performed on digital personal data", including storage, sharing and "erasure or destruction" | Keeping a backup is processing; so is deleting it. In our view "otherwise making available" covers remote viewing. |
| Specified purpose, s.2(za) | "the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal" | The notice fixes the limits of use. For section 7(a) data, which needs no notice, state the purpose in writing at collection. |
| Certain legitimate uses, s.2(d) | "the uses referred to in section 7" | A closed list with no general "legitimate interests" ground. Trayambic's article on section 7 covers each use. |
| Personal data breach, s.2(u) | "any unauthorised processing" or "accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access" that "compromises the confidentiality, integrity or availability" of personal data | There is no harm threshold. Ransomware that only locks files is a breach, and s.8(6) requires intimation to the Board and each affected person. |
| Gain and loss, s.2(o) and (p) | "gain" means "a gain in property or supply of services, whether temporary or permanent", or a chance to earn more; "loss" is the mirror image | When fixing a penalty, the Board weighs whether the person "realised a gain or avoided any loss" (s.33(2)(d)). "Loss" also shapes the employer use in s.7(i). |
Putting the glossary to work
- Label each product and client contract fiduciary or processor under s.2(i) and s.2(k), not GDPR's "controller" and "processor".
- Mark where paper becomes digital: the scan, photo or typed entry.
- Flag datasets that include anyone under 18 or acting through a guardian.
- Write the specified purpose at every collection point, including those relying on section 7(a).
- Copy the s.2(u) wording, including "loss of access", into your incident policy so ransomware and outages reach the breach process.
- Do not rely on contract wording to change a role: s.8(1) keeps the fiduciary responsible "irrespective of any agreement to the contrary".
Labels first, duties second
Every later duty borrows these words. A wrong label (processor for fiduciary, adult for child, anonymous for identifiable) carries into every notice, contract and incident decision. Trayambic's data inventory guide shows how to record them against each activity.
Key takeaways
- Section 2 of the DPDP Act has been in force since 13 November 2025; most duties that use its 28 definitions commence on 13 May 2027.
- Roles follow facts: a data fiduciary decides purpose and means 'alone or in conjunction with other persons', and 'person' includes unincorporated associations and the State.
- The Act covers only digital personal data, but paper data comes in once digitised; there is no separate sensitive-data category, and a child is anyone under 18.
- A personal data breach includes accidental 'loss of access', with no harm threshold, so ransomware that only locks files is a breach.
- 'Gain' and 'loss' are defined because the Board weighs any gain made or loss avoided when setting a penalty (s.33(2)(d)).
MORE BLOG POSTSRETURN TO BLOGS
Your First DPDP Task: A Data Inventory in Two Weeks
The DPDP Act never asks for a data inventory, yet notices, access requests, erasure, breach scoping and proof of consent all depend on one.
AS OF OCTOBER 2026 · 4 MIN READREAD THE BLOG POST
Run a Breach Tabletop Exercise Before May 2027
A 90-minute scripted drill, with injects from the first email to the 72-hour Board report, will show where your breach plan breaks before a real incident does.
AS OF OCTOBER 2026 · 4 MIN READREAD THE BLOG POST
Privacy Training That Works for Small Teams
The DPDP Act never says 'train your staff', but it holds you to what they do; here is a 90-minute module, four role add-ons, a calendar and a way to prove it all happened.
AS OF OCTOBER 2026 · 4 MIN READREAD THE BLOG POST