Rule 2: Definitions
Rule 2 defines a handful of terms used elsewhere in the Rules — short, technical, and easy to skim past, but worth understanding because three of them (user account, techno-legal measures, verifiable consent) shape how several other rules are read.
Quick summary
What Rule 2 says
- “Act” means the Digital Personal Data Protection Act, 2023.
- “Techo-legal measures” means the measures referred to under Rules 20 and 22 — i.e. how the Data Protection Board and the Appellate Tribunal function as digital offices.
- “User account” means the online account a Data Principal registers with a Data Fiduciary, including any profile, page, handle, email address, mobile number or other similar presence through which she accesses that Data Fiduciary's services.
- “Verifiable consent” means consent obtained under Rule 10 (for a child) or Rule 11 (for a person with a disability who has a lawful guardian).
- Any word or expression used in the Rules but not defined here takes the meaning assigned to it in the Act itself.
Breaking it down
This is a short rule, but each of its four terms does real work elsewhere:
“User account” is broader than it sounds. It isn't just a formal login — it explicitly includes “any profiles, pages, handles, email address, mobile number and other similar presences” through which someone accesses your service. A WhatsApp Business number a customer messages regularly, or a loyalty-programme phone-number record, can count as a user account for the purposes of the Rules.
“Verifiable consent” is a defined, narrower concept than ordinary consent. The Act talks about consent generally; the Rules use “verifiable consent” specifically for the higher bar applied to children's data and to data of persons with disabilities who have a guardian. Whenever you see “verifiable consent” elsewhere in the Rules, it's pointing back to the identity-checking process in Rules 10 and 11, not ordinary click-to-consent.
“Techo-legal measures” is really about the Board and Tribunal, not about you. It's easy to assume this term describes security measures a business must take. It doesn't — it specifically describes how the Data Protection Board (Rule 20) and Appellate Tribunal (Rule 22) can conduct proceedings digitally, without requiring anyone's physical presence.
Why this rule matters
Definitions rules rarely feel exciting, but misreading one of these four terms can lead a compliance team to misread an obligation elsewhere — for instance, assuming “user account” only means a formal login-based account, and missing that a registered WhatsApp number or loyalty-card record counts too.
Real-world example
Who needs to care about this rule
- Anyone drafting or reviewing compliance documentation — getting these four terms right avoids misreading the rules that use them.
- Product and engineering teams mapping out what counts as a “user account” for retention and notice purposes.
Common questions
Is “verifiable consent” the same as ordinary consent under the Act?
Does “user account” only mean a formal login?
Where do I find definitions for terms not listed in Rule 2?
Related rules
Rule 1 — Short Title and Commencement
Read the previous rule in sequence.
Read Rule 1Rule 3 — Notice Given by Data Fiduciary to Data Principal
Continue to the next rule in sequence.
Read Rule 3Full DPDP Rules Guide
Back to the overview page, with the complete rule-by-rule guide and Schedules at a glance.
View all 23 rulesDPDP Dictionary
Plain-language definitions of every key DPDP term — from the Act as well as the Rules.
Browse the dictionary