Aadhaar Act, 2016
The law that governs the Aadhaar identity number and its authentication.
Reference
DPDP Dictionary: Data Privacy & DPDP Act Terms Explained
136 terms from the DPDP Act, 2023, the DPDP Rules, 2025 and everyday data protection practice, each with a plain-language meaning.
136 termsReviewed October 2026
Browse by theme
- Core concepts & roles27
- Consent, notice & lawful grounds22
- Data Principal rights & duties8
- Security & breach24
+ 4 more categories below
136 of 136 terms
A7 terms
Access Control
Limiting who can see or change personal data and systems.
Accountability
Being responsible for compliance and able to prove it.
Age Verification
Checking that a user is the age they claim to be, so children can be identified and protected.
Anonymisation
Changing data so that individuals can no longer be identified, by anyone, by any reasonably likely means.
Appellate Tribunal
The body that hears appeals against orders of the Data Protection Board. The Act names the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
Automated Decision-Making
Decisions made by software with little or no human involvement.
B8 terms
Bar of Civil Court Jurisdiction
Section 39: civil courts cannot hear matters that the Board is empowered to decide.
Behavioural Monitoring and Tracking
Observing and recording what a person does, such as clicks, location or usage patterns, over time.
Biometric Data
Data about a person’s physical or behavioural traits, used to identify them, such as fingerprints, iris and face.
Blocking of Access
The Central Government’s power to direct that access to a Data Fiduciary’s services in India be blocked.
Board Inquiry (Adjudication)
The Board’s process of examining a complaint or breach, hearing the parties and deciding the outcome.
Breach Intimation
The duty to tell each affected Data Principal and the Data Protection Board about a personal data breach.
Breach Register
An internal log of every security incident and breach, what happened, and what was done.
Business Contact Information
The published contact details of the person who can answer a Data Principal’s questions about processing.
C15 terms
Call for Information
The Government’s power to require the Board, a fiduciary or an intermediary to supply information.
Certain Legitimate Uses
The listed situations in Section 7 where personal data can be processed without consent.
CERT-In
India’s Computer Emergency Response Team, which receives reports of cybersecurity incidents.
Child
An individual who has not completed 18 years of age.
Clear Affirmative Action
A deliberate act, such as ticking a box or pressing a button, through which a person shows consent.
Commencement
The date on which a law or part of it begins to apply.
Consent
The Data Principal’s free, specific, informed, unconditional and unambiguous agreement to processing, shown by a clear affirmative action.
Consent Artefact
A machine-readable record of a consent: who gave it, to whom, for what purpose and for how long.
Consent Banner
A pop-up or bar on a website or app that asks visitors for permission to use cookies and trackers.
Consent Management Platform (CMP)
Software that a business uses to collect, record, honour and withdraw consent.
Consent Manager
A registered entity that gives a Data Principal one place to give, manage, review and withdraw consent.
Consistency with Other Laws
Section 38: the Act applies in addition to other laws, and prevails over them where they truly conflict.
Cookies
Small files that a website stores in a browser to remember settings, sessions and behaviour.
Credential Stuffing
Using leaked username-password pairs from one site to break into accounts on another.
Cross-Border Data Transfer
Sending personal data to another country, including storing it on servers abroad.
D32 terms
Dark Patterns
Interface designs that push or trick people into choices they would not otherwise make.
Data
A representation of information, facts, concepts, opinions or instructions that a person or a computer can communicate, interpret or process.
Data Accuracy
Making sure personal data is complete, accurate and consistent.
Data Audit
A review of how personal data is collected, used, stored and protected, compared with the law and your own policies.
Data Backup
A separate copy of data kept so that processing can continue after loss, ransomware or a failure.
Data Broker
A business that collects personal data from many sources and sells or licenses it to others.
Data Controller
The GDPR term for the organisation that decides why and how personal data is processed. The DPDP term is Data Fiduciary.
Data Erasure
Permanently removing personal data so that it can no longer be used.
Data Fiduciary
A person or organisation that, alone or with others, decides why and how personal data is processed.
Data Localisation
A rule that certain data must be stored or processed within India.
Data Mapping (Data Inventory)
A record of what personal data you hold, where it sits, why you hold it and who it goes to.
Data Minimisation
Collecting only the personal data that is needed for the stated purpose.
Data Portability
The right to receive your data in a reusable format and move it to another service. The DPDP Act does not give this right.
Data Principal
The individual to whom the personal data relates. In the Act’s wording, the person whose data it is.
Data Processing Agreement (DPA)
A written contract between a Data Fiduciary and a Data Processor that sets how personal data may be handled.
Data Processor
A person or organisation that processes personal data on behalf of a Data Fiduciary.
Data Protection Board of India
The independent body that inquires into personal data breaches and complaints and can impose penalties.
Data Protection Impact Assessment (DPIA)
A structured review of the privacy risks of a processing activity, and the steps to reduce them.
Data Protection Officer (DPO)
An individual appointed by a Significant Data Fiduciary to represent it and to answer to the Board.
Data Retention Policy
A written rule for how long each type of personal data is kept and when it is deleted.
Data Sharing
Making personal data available to another organisation.
Data Subject
The GDPR term for the individual the data is about. The DPDP term is Data Principal.
Deemed Consent
A term from earlier draft laws for situations where consent is presumed. The final Act uses “certain legitimate uses” instead.
Device Identifier
A unique code for a phone, computer or app installation, such as an advertising ID.
DigiLocker
The Government of India’s digital document service, mentioned in the Rules as one way to verify a parent’s age and identity.
Digital Office
An office that functions by digital means, with proceedings held and records kept electronically.
Digital Personal Data
Personal data in digital form. The Act also covers non-digital personal data once it is digitised.
Digitised Personal Data
Personal data first collected in non-digital form (such as paper) and later converted into digital form.
DPDP Act, 2023
The Digital Personal Data Protection Act, 2023, India’s main law on the processing of digital personal data.
DPDP Compliance
Meeting the duties and respecting the rights in the DPDP Act and Rules.
DPDP Rules, 2025
The Digital Personal Data Protection Rules, 2025, which supply the operational detail for the Act.
Duties of the Data Principal
The obligations the Act places on individuals: follow the law, do not impersonate, do not suppress information, do not file false complaints.
E3 terms
Employment Purposes
A legitimate use that lets an employer process employee data without consent for employment, or to protect the business from loss or liability.
Encryption
Scrambling data with a key so that only authorised people or systems can read it.
Exemptions (Section 17)
Situations where some or all of the Act’s duties do not apply.
F1 term
Financial Data
Personal data about a person’s accounts, transactions, income, credit and payments.
G3 terms
Gazette Notification
The official publication of a law, rule or order in the Gazette of India.
GDPR
The European Union’s General Data Protection Regulation, in force since May 2018.
Grievance Redressal
The process through which a Data Principal complains to a Data Fiduciary or Consent Manager and gets a response.
H1 term
Health Data
Personal data about a person’s physical or mental health, treatment and medical history.
I6 terms
Incident Response Plan
A written plan that says who does what when a security incident or breach happens.
Independent Data Auditor
An outside auditor that a Significant Data Fiduciary must appoint to check compliance with the Act.
Information Technology Act, 2000
India’s main law on electronic records, cybercrime and intermediaries, which has also governed data protection until now.
Insider Threat
A risk from people inside the organisation, such as staff or contractors, who misuse their access, deliberately or by mistake.
IP Address
A number that identifies a device on a network.
Itemised Notice
A notice that lists each category of personal data and each purpose separately, instead of using vague wording.
L4 terms
Lawful Guardian
A person legally authorised to act for a child or for a person with a disability.
Legitimate Interest
A lawful ground under GDPR that lets organisations process data for their own legitimate purposes. The DPDP Act has no such ground.
Location Data
Information about where a person or device is, from GPS, mobile networks, Wi-Fi or IP addresses.
Logging and Monitoring
Recording activity on systems and watching those records to spot misuse or attacks.
M6 terms
Masking
Hiding part of a data value so that it cannot be read in full.
Mediation (Alternate Dispute Resolution)
A way of resolving a dispute with the help of a neutral mediator, as an alternative to a formal order.
Medical Emergency
A legitimate use that allows processing without consent to respond to a medical emergency involving a threat to life or an immediate threat to health.
Metadata
Data about data, such as when, where and by whom a record was created or sent.
Monetary Penalty
The money the Data Protection Board can order a person to pay after finding a breach.
Multi-Factor Authentication (MFA)
Logging in with more than one proof of identity, such as a password and a code from a phone.
N1 term
Notice
The statement a Data Fiduciary gives a Data Principal before or when asking for consent.
O1 term
Obfuscation
Making data hard to understand so that it is of little use to someone who gets it without permission.
P16 terms
Penetration Testing
A controlled attempt by security testers to break into a system, to find weaknesses before real attackers do.
Person
The Act’s wide word for anyone who can hold rights or duties, including individuals, companies, firms and the State.
Person with Disability (who has a lawful guardian)
A person whose disability, as defined by law, means a lawful guardian acts for them in matters of consent.
Personal Data
Any data about an individual who can be identified by or in relation to that data.
Personal Data Breach
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
Personal or Domestic Use
Processing by an individual for personal or household purposes, which is outside the Act.
Phishing
A fake message that tricks a person into revealing passwords or data, or running harmful software.
Privacy by Design
Building privacy protections into products and processes from the start, not adding them later.
Privacy Policy
A public document that explains how an organisation handles personal data.
Processing
Any wholly or partly automated operation performed on digital personal data.
Processing Logs
Records of operations performed on personal data, such as who accessed or changed it and when.
Profiling
Using data to evaluate or predict things about a person, such as interests, behaviour or creditworthiness.
Pseudonymisation
Replacing direct identifiers with codes, while the data can still be linked back to a person with extra information.
Publicly Available Personal Data
Personal data that the Data Principal herself made public, or that someone made public under a legal obligation. The Act does not apply to it.
Purpose Limitation
Using personal data only for the purposes the person was told about or that the law allows.
Puttaswamy Judgment
The 2017 Supreme Court decision, Justice K.S. Puttaswamy (Retd.) v. Union of India, that recognised privacy as a fundamental right.
R11 terms
Ransomware
Malware that locks or encrypts a victim’s data and demands payment to restore it.
Reasonable Security Safeguards
The technical and organisational measures a Data Fiduciary must take to protect personal data and prevent a breach.
Record of Processing Activities (RoPA)
A written register of each processing activity, its purpose, data categories, recipients and retention.
Research, Archiving and Statistical Exemption
An exemption for processing needed for research, archiving or statistics, if done to the standards in the Second Schedule.
Retention Period
The length of time personal data may be kept.
Right to Access Information
A Data Principal’s right to ask for a summary of her personal data and how it is processed.
Right to Be Forgotten
A popular name for a person’s right to have data about them deleted. The DPDP Act frames it as a right to erasure.
Right to Correction
A Data Principal’s right to have inaccurate or misleading data corrected, incomplete data completed and outdated data updated.
Right to Erasure
A Data Principal’s right to ask for her personal data to be erased.
Right to Nominate
A Data Principal’s right to nominate another person to exercise her rights if she dies or becomes unable to act.
Right to Privacy
The fundamental right of individuals to privacy, recognised by the Supreme Court as part of Article 21 of the Constitution.
S9 terms
Schedule (Penalty Schedule)
The table at the end of the Act that lists the maximum penalty for each type of breach.
Sensitive Personal Data
A category of more protected data under the older IT Act rules, such as health, financial and biometric data. The DPDP Act has no such category.
Significant Data Fiduciary
A Data Fiduciary, or class of fiduciaries, that the Central Government notifies as significant because of the risk it poses.
SPDI Rules, 2011
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Specified Purpose
The purpose stated in the notice and for which the Data Principal gave consent.
Start-up Exemption
The Government’s power to relieve notified classes of fiduciary, including start-ups, of certain duties.
State
The Government and its instrumentalities, as the term is used in Article 12 of the Constitution.
Storage Limitation
Keeping personal data only for as long as it is needed.
Sub-processor
A vendor that a Data Processor hires to handle personal data for it.
T4 terms
Targeted Advertising
Advertising chosen for a person based on data about their behaviour or characteristics.
Third Party
Anyone other than the Data Principal, the Data Fiduciary and the fiduciary’s own processors.
Tokenisation
Replacing a sensitive value with a random token, with the real value stored safely elsewhere.
Traffic Data
Information about the flow of communications, such as IP addresses, timestamps and connection details, rather than the content.
V6 terms
Vendor Risk Management
Checking and monitoring the privacy and security of the vendors that handle your data.
Verifiable Parental Consent
Consent from a child’s parent or lawful guardian that the Data Fiduciary has checked is genuine.
Virtual Token
A tokenised identifier that stands in for a real identity detail, such as an ID number, without revealing it.
Voluntary Provision of Data
A legitimate use where a person gives personal data for a specified purpose and has not said she does not consent to its use.
Voluntary Undertaking
A written commitment to the Board, by a fiduciary, to take specified steps, which the Board can accept to end proceedings.
Vulnerability Assessment
A structured check for weaknesses in systems that attackers could use.
W1 term
Withdrawal of Consent
The Data Principal’s right to take back consent at any time, as easily as it was given.
Z1 term
Zero Trust
A security approach that trusts no user or device by default and checks every access request.
How to use this dictionary. Terms start with the Act and Rules (roles, consent, rights, security, penalties), then related laws and technical ideas. For the law itself, read the DPDP Act guide and the DPDP Rules guide. This page gives general information, not legal advice.