Section 2: Definitions
Section 2 is the Act's dictionary — 28 defined terms, from “automated” to “State,” that every other section relies on. It doesn't create obligations by itself, but misreading one of these definitions is the single easiest way to misjudge whether the rest of the Act applies to you.
Quick summary
What Section 2 says
- Clauses (a)–(zb) — define, in order: Appellate Tribunal, automated, Board, certain legitimate uses, Chairperson, child, Consent Manager, data, Data Fiduciary, Data Principal, Data Processor, Data Protection Officer, digital office, digital personal data, gain, loss, Member, notification, person, personal data, personal data breach, prescribed, proceeding, processing, “she,” Significant Data Fiduciary, specified purpose, and State.
- Data Principal (clause j) — the individual the data is about, and for a child or a person with disability, includes their parent or lawful guardian acting on their behalf.
- Data Fiduciary (clause i) — whoever, alone or with others, decides why and how personal data is processed. This is the party the Act's obligations mostly fall on.
- Data Processor (clause k) — anyone who processes personal data on behalf of a Data Fiduciary, without deciding the purpose or means themselves.
- Personal data (clause t) — any data about an individual who is identifiable by or in relation to that data.
- Processing (clause x) — a very broad, non-exhaustive list of operations: collection, recording, organisation, structuring, storage, adaptation, retrieval, use, combination, indexing, sharing, disclosure, restriction, erasure or destruction.
- Personal data breach (clause u) — any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
- Child (clause f) — an individual who has not completed the age of eighteen years.
- Significant Data Fiduciary (clause z) — any Data Fiduciary or class of Data Fiduciaries the Central Government notifies as such under Section 10, based on factors like the volume and sensitivity of data they process.
- Consent Manager (clause g) — a person registered with the Board who acts as a single point of contact letting a Data Principal give, manage, review and withdraw consent through an accessible, transparent, interoperable platform.
Breaking it down
Rather than list all 28 definitions in full legal language, it's more useful to group them by what they're actually doing in the Act:
The people and roles
Data Principal, Data Fiduciary, Data Processor, Significant Data Fiduciary, Consent Manager, Data Protection Officer, Chairperson, Member, Board
These define who a given obligation or right attaches to.
The subject matter
data, personal data, digital personal data, processing, automated
These define what the Act actually regulates. The Act only covers digital personal data (clause n): personal data in digital form, or non-digital data that is later digitised — see Section 3 for how that plays out in practice.
The failure modes
personal data breach, gain, loss
These define the harms the Act is designed to catch and the factors the Board weighs when a breach happens or when it sets a penalty.
The mechanics
notification, prescribed, proceeding, digital office, certain legitimate uses, specified purpose, State, person
Largely procedural or administrative terms that tell you where to look for further detail (“prescribed” always means “set out in the DPDP Rules”) or how broadly a term like “person” sweeps (clause s: an individual, a Hindu undivided family, a company, a firm, an association of persons, the State, and any other artificial juristic person).
Why this section matters
It's easy to skim past a definitions section, but in the DPDP Act almost every compliance question eventually comes down to one: “does this term apply to us, and in what sense?” Whether your organisation is a Data Fiduciary or a Data Processor changes which obligations fall on you directly. Whether a user counts as a “child” changes whether Section 9's parental-consent requirement applies. Whether an incident meets the definition of “personal data breach” determines whether Section 8(6)'s mandatory intimation to the Board is triggered at all. Section 2 is where all of these questions get settled.
Real-world example
Northbridge Analytics, a B2B SaaS company processing client employee data
Northbridge's legal team uses Section 2 to work out its own role under the Act:
- Is Northbridge a Data Fiduciary or a Data Processor? — For its enterprise clients' HR software, Northbridge only processes employee data exactly as instructed by the client, who decides what's collected and why. That makes Northbridge a Data Processor for that data — the client is the Data Fiduciary.
- Is Northbridge a Data Fiduciary anywhere else? — Yes — for its own marketing website's visitor analytics, Northbridge itself decides what's collected and why. There, it's the Data Fiduciary.
- Does a security incident count as a “personal data breach”? — When a support engineer accidentally emails a spreadsheet of user records to the wrong client contact, Northbridge checks clause (u): this is accidental disclosure that compromises confidentiality — it meets the definition, triggering Section 8(6)'s breach-intimation obligation.
Who needs to care about this section
- Every organisation trying to determine its own role — the Data Fiduciary vs. Data Processor distinction changes which sections apply directly to you versus which apply through your contract with a Fiduciary.
- Product and engineering teams — handling anything that might be a “child” user — the definition (under 18) is stricter than many platforms' own age-gating assumptions.
- Incident-response teams — deciding whether an event meets the “personal data breach” definition determines whether the clock starts on Section 8(6)'s mandatory intimation.
Common questions
Does "personal data" only mean things like name and phone number?
Is anonymised or aggregated data still "personal data" under the Act?
Where do I find the definition of a term the Act uses but doesn't define here?
Related sections
Section 3 — Application of Act
Continue to the next section in sequence.
Read Section 3Section 1 — Short Title and Commencement
Go back to the previous section.
Read Section 1Chapter I — Preliminary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsDPDP Dictionary
A plain-language glossary covering these same terms, plus concepts from the DPDP Rules.
Browse the dictionary