Person
The Act’s wide word for anyone who can hold rights or duties, including individuals, companies, firms and the State.
In the Act, a "person" is anyone who can hold legal rights and duties: a human being, a company, a firm, a society or even the government. This wide meaning decides who must follow the law.
Meaning of Person
"Person" includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and every artificial juristic person. This is why a Data Fiduciary can be a government department as well as a private company.
Section 2 defines "person" broadly. It includes an individual, a Hindu undivided family, a company, a firm, an association of persons or a body of individuals whether incorporated or not, the State, and every artificial juristic person that does not fall into the earlier groups. The list is deliberately open-ended. If an entity can sign contracts, own property or be sued, it is very likely a person for this Act.
That width matters because the other key definitions are built on it. A Data Fiduciary is any person who alone or with others decides the purpose and means of processing. A Data Processor is a person who processes on behalf of a fiduciary. So a partnership firm, a trust, a housing society, a sole proprietor, a listed company and a municipal body can each be a fiduciary, depending only on what they do with personal data.
Do not confuse "person" with "individual". The Act uses "individual" for the human whose data is processed, and "Data Principal" for that individual in the role of data owner. A company is a person, but it is never a Data Principal, because the Act protects personal data about natural persons. A company's own registration number or turnover is not personal data, while the email address of its director is.
The definition also explains why the Act binds foreign businesses. Section 3(b) reaches processing outside India connected with offering goods or services to people in India, and the foreign company doing that is a "person" in the same sense. The term does not by itself create obligations. It only identifies who can be bound, and the roles of fiduciary, processor or Consent Manager then supply the actual duties.
Examples of Person
A partnership firm that runs a clinic and a state government department are both "persons" that can be Data Fiduciaries.
A housing society in Pune installs a visitor-management app that records names, phone numbers and photographs. The society is an association of persons, so it counts as a person and, because it decides how the visitor data is used, it is a Data Fiduciary.
An education group runs three separate companies for its schools, its online courses and its publishing arm. Each is its own person, so student data moving between them is sharing between different persons and needs a notice and a lawful basis.
A municipal corporation collects residents' details for a property-tax portal. As part of the State it is a person, and it must still publish a contact for questions and observe security safeguards unless a notified exemption applies.
Why Person matters
The practical effect is that size and type of organisation are not an escape route. A two-person design studio, a village-level cooperative, a family-run diagnostic lab and a global platform are all persons, and each becomes a Data Fiduciary once it decides why and how to process personal data. Penalties are directed at the person who breaches, so a trust or society cannot say it is not a business.
It also tells you where to look for accountability. Because the State is a person, government departments face the same Data Principal rights and many of the same duties, subject to the exemptions in Section 17. Treating "person" as a wide term helps you spot hidden fiduciaries in your ecosystem, such as franchisees, associations and joint ventures.
How it works in practice
- 1List every legal entity in your group and in your partner network, and decide for each whether it decides the purpose and means of processing, only processes on instructions, or does neither. This role mapping is the starting point for contracts and notices.
- 2Check how each entity is described in your agreements. A joint venture, a franchisee or a trust is a separate person, so the data-sharing terms between you should be written as between two persons, with clear roles.
- 3For small and informal bodies, such as a resident welfare association, a temple trust or a coaching centre run by a partnership, confirm whether they handle digital personal data in any way other than purely personal or domestic use. If yes, they are persons with fiduciary duties.
- 4When drafting your privacy notice, identify the exact legal entity that is the Data Fiduciary, with its registered name and contact details, rather than using a brand name that may not match any legal person.
- 5Record in your data inventory whether the data relates to individuals or to entities. Business-only data, like a company's GST number, falls outside the Act, but data of its named contacts does not.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Thinking the Act applies only to companies. Firms, trusts, societies, proprietors and government departments are all persons, and any of them may be a fiduciary.
Treating a brand or app name as the Data Fiduciary. The fiduciary is the registered legal person behind it, and the notice should name that entity.
Assuming a company can ask for access or erasure as a Data Principal. Those rights belong to the individual, including a company's employees or directors, but not to the company itself.
Ignoring group structure. Passing data from one group company to another is sharing between separate persons, not an internal movement.
Compliance tips
Name the exact legal entity in every notice, contract and grievance page, along with its registered address and contact details.
Draw a simple entity chart showing which person decides purposes and which only processes. Update it after every acquisition, joint venture or outsourcing change.
Do not rely on being small or non-commercial to postpone compliance. A body is covered because of what it does with digital personal data, not because of its legal form.
When a partner is a separate person, put the roles, security expectations and breach-reporting duties in writing in the contract.
Common questions about Person
Is a company a Data Principal under the DPDP Act?
No. A company is a "person" and can be a Data Fiduciary or Data Processor, but the Data Principal is the individual to whom personal data relates. Rights such as access and erasure belong to individuals, including the staff and directors of a company.
Does the Act apply to a sole proprietor or small firm?
Yes, if it processes digital personal data beyond purely personal or domestic use. A sole proprietor is an individual and a firm is a person; either can be a Data Fiduciary. Smaller organisations may be offered relaxations through notified classes, but there is no blanket small-business exemption in the Act.
Is the government a person under the Act?
Yes. Section 2 includes the State in the definition of person. Government departments can therefore be Data Fiduciaries. Special provisions, such as Section 7 [legitimate uses](term/legitimate-uses) and Section 17 exemptions, apply to the State, but it is not outside the Act.
What is the difference between a person and an individual?
An individual is a natural human being, while a person is wider and covers companies, firms, societies and the State as well. The Act uses individual for the data subject and person for those who can be bound by duties.