Skip to content
TrustOS

DPDP Act guide

DPDP Act glossary: the terms in plain English

The DPDP Act uses its own vocabulary, and some words mean something slightly different from what you might expect from GDPR or everyday use. Where a definition matters for a decision, rely on the text of the Act or the Rules.

The law as of October 2026.

In shortAs of October 2026

  1. Data Fiduciary and Data Principal are the Act's terms for the organisation and the individual.
  2. The Act covers digital personal data, including data collected offline and later digitised.
  3. A child under the Act is anyone under 18.
  4. There is no portability right and no general legitimate interests ground.

Why the words matter

Two people in the same meeting can mean different things by "processor" or "consent". Agreeing on the Act's terms early saves arguments later, especially when legal, security and product teams are working from the same plan.

The people and organisations

Every processing activity has a Data Principal, the person the data is about, and a Data Fiduciary, who decides why and how it is processed. A Data Processor processes on the fiduciary's behalf. The Data Protection Board enforces the law, and Consent Managers sit between people and fiduciaries to manage consent.

The terms that differ from GDPR

If your team learned privacy through GDPR, a few differences are worth noting. "Data Fiduciary" is roughly a controller and "Data Principal" roughly a data subject. There is no separate category of sensitive personal data in the Act. There is no general legitimate interests ground; section 7 is a closed list. And there is no data portability right.

Using this glossary

The meanings given are plain summaries. The legal definitions are in the Act and in the DPDP Rules, 2025, notified on 13 November 2025; check for later amendments. TrustOS uses the same terms across its workspace and Privacy Centre, so the words your teams see in the product match the law. This is not legal advice.

Key DPDP terms, in plain English

TermWhat it means
Data PrincipalThe individual the personal data is about. For a child, it includes the parent or lawful guardian.
Data FiduciaryThe person or organisation that decides the purpose and means of processing personal data.
Data ProcessorAnyone who processes personal data on behalf of a Data Fiduciary, such as a cloud host, payroll provider or call centre.
Personal dataAny data about an individual who is identifiable by or in relation to that data.
Digital personal dataPersonal data in digital form, or collected offline and later digitised. The Act covers this.
ProcessingAlmost anything done to personal data by automated means, including collection, storage, use, sharing and erasure.
ConsentAgreement that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, for a specified purpose.
NoticeThe information a Data Fiduciary gives when asking for consent: what data, for what purpose, and how to withdraw, use rights and complain.
Legitimate usesThe closed list in section 7 of situations where personal data can be processed without consent.
Consent ManagerA company registered with the Board that lets a person give, manage, review and withdraw consent through one platform.
Significant Data FiduciaryA Data Fiduciary, or class of them, notified by the Central Government and given additional duties.
Data Protection OfficerThe India based officer a Significant Data Fiduciary must appoint, answerable to its board or governing body.
Data Protection Impact AssessmentA periodic assessment of the risks a Significant Data Fiduciary's processing poses to people, with the measures to manage them.
Personal data breachAny unauthorised processing, or accidental disclosure, loss, alteration or destruction, that compromises personal data.
Data Protection Board of IndiaThe body set up under the Act to inquire into breaches, direct remedies and impose penalties.
ChildAn individual who has not completed 18 years of age.
Verifiable consentConsent from a parent or lawful guardian, checked in a way the Rules describe, before a child's data is processed.
NominationA Data Principal's right to name someone to exercise their rights in the event of death or incapacity.
Grievance redressalThe Data Principal's right to a readily available way to complain to the Data Fiduciary or Consent Manager, and get an answer.

Official sources

This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.

Where TrustOS fits

The modules that help with this

Module

Data inventory

A working record of what personal data you hold, where it sits and who touches it.

Learn more

Module

Privacy Centre

One page where your customers manage consent, make requests and track them.

Learn more

Questions

Common questions

Is a Data Fiduciary the same as a GDPR controller?

The ideas are close: both decide the purpose and means of processing. The duties attached to each differ, so do not assume GDPR compliance meets the DPDP Act.

Does the Act cover paper records?

It covers personal data collected in digital form, or collected in non digital form and then digitised. Paper records that are never digitised fall outside it.

Is health or financial data treated as sensitive?

The Act does not create a separate sensitive category. Sensitivity still matters, for example in how the Board weighs a penalty and in which organisations may be notified as Significant Data Fiduciaries.

More on the Act

See it with your data

Show us where your personal data lives. We will show you TrustOS running on it.

A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.

Book a demoTake the gap assessment
Or get a rollout proposal in two minutes
  1. Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
  2. Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
  3. Step 3A first phase you can planModules, owners and effort, written down for you to keep.