20 terms·no circular definitions
Every Term, Defined Without Jargon
Twenty terms you will meet in the Act, your DPA and your first audit — each explained without pointing at another definition.
- Data Fiduciary
- Any person who alone or with others determines the purpose and means of processing personal data. If you decide why data is collected, this is you.
- Data Principal
- The individual the personal data relates to. For a child, it includes the parent or lawful guardian; for a person with disability, their lawful guardian.
- Data Processor
- A person who processes personal data on behalf of a Data Fiduciary. Your vendors are processors, and you stay accountable for them.
- Significant Data Fiduciary
- A Data Fiduciary designated by the Government based on data volume and sensitivity and risk to rights. Extra duties follow: an India-based DPO, an independent auditor and periodic DPIAs.
- Personal data
- Any data about an individual who is identifiable by or in relation to it. Note the breadth — it is not limited to obviously sensitive fields.
- Processing
- Any automated operation on personal data — collection, storage, use, sharing, alignment, erasure. Reading it counts.
- Consent Manager
- A registered entity through which a Data Principal can give, manage, review and withdraw consent, via an accessible, interoperable platform.
- Notice
- The itemised statement given before or at the time of collection, describing the data sought, the purpose, and how to exercise rights and complain.
- Legitimate use
- The narrow set of grounds in Section 7 that permit processing without consent — voluntary provision, employment, medical emergency, disaster response and certain State functions.
- Personal data breach
- Any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability.
- Data Protection Board
- The adjudicating body that hears breach reports and complaints and imposes penalties. You reach it after the Fiduciary's own grievance route is exhausted.
- Grievance Officer
- The contact a Data Fiduciary must publish for data principals to raise complaints. Publishing these details is mandatory, not optional.
- RoPA
- Record of Processing Activities — the inventory of what personal data you process, for what purpose, on what basis, with whom and for how long.
- DPIA
- Data Protection Impact Assessment — a structured review of the rights risk in a processing activity, together with the mitigations applied and the residual risk accepted.
- Purpose limitation
- The principle that data collected for one stated purpose may not be quietly reused for another. Most compliance failures start here.
- Data minimisation
- Collecting only the personal data necessary for the stated purpose. The cheapest control there is, and the one most often skipped.
- Verifiable parental consent
- Consent for a child's data obtained in a way you can actually evidence. A self-declared date of birth is not verification.
- Erasure
- Deletion once the purpose is served or consent is withdrawn, unless retention is required by law. It must be real deletion, including backups within a defined window.
- Eighth Schedule
- The list of 22 languages of the Constitution. Notices must be available in English or any of these, at the Data Principal's option.
- Nomination
- The right of a Data Principal to nominate another individual to exercise their rights in the event of death or incapacity.