Data protection · Provision
The words the rest of the Act runs on: personal data, processing, Data Fiduciary, Data Processor, Data Principal, child and personal data breach. (Section 2, Digital Personal Data Protection Act, 2023.) In force since 13 November 2025 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Section 2 of the DPDP Act 2023 defines the terms the rest of the Act depends on. Personal data is any data about an individual who is identifiable by or in relation to it. A Data Fiduciary decides the purpose and means of processing; a Data Processor processes on its behalf; a Data Principal is the person the data is about, including a child's parents or lawful guardian. A child is anyone under eighteen. A personal data breach is any unauthorised processing, or accidental disclosure, loss or destruction, that compromises the confidentiality, integrity or availability of personal data.
2. Definitions.— In this Act, unless the context otherwise requires,— (a) "Appellate Tribunal" means the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 (24 of 1997); (b) "automated" means any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data; (c) "Board" means the Data Protection Board of India established by the Central Government under section 18; (d) "certain legitimate uses" means the uses referred to in section 7; (e) "Chairperson" means the Chairperson of the Board; (f) "child" means an individual who has not completed the age of eighteen years; (g) "Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform; (h) "data" means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means; (i) "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data; (j) "Data Principal" means the individual to whom the personal data relates and where such individual is— (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf; (k) "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary; (l) "Data Protection Officer" means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10; (m) "digital office" means an office that adopts an online mechanism wherein the proceedings, from receipt of intimation or complaint or reference or directions or appeal, as the case may be, to the disposal thereof, are conducted in online or digital mode; (n) "digital personal data" means personal data in digital form; (o) "gain" means— (i) a gain in property or supply of services, whether temporary or permanent; or (ii) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration; (p) "loss" means— (i) a loss in property or interruption in supply of services, whether temporary or permanent; or (ii) a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of legitimate remuneration; (q) "Member" means a Member of the Board and includes the Chairperson; (r) "notification" means a notification published in the Official Gazette and the expressions "notify" and "notified" shall be construed accordingly; (s) "person" includes— (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub-clauses; (t) "personal data" means any data about an individual who is identifiable by or in relation to such data; (u) "personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data; (v) "prescribed" means prescribed by rules made under this Act; (w) "proceeding" means any action taken by the Board under the provisions of this Act; (x) "processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction; (y) "she" in relation to an individual includes the reference to such individual irrespective of gender; (z) "Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10; (za) "specified purpose" means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder; and (zb) "State" means the State as defined under article 12 of the Constitution.
| Term | Meaning, in short | Clause |
|---|---|---|
| Personal data | Any data about an individual who is identifiable by or in relation to it | s.2(t) |
| Digital personal data | Personal data in digital form | s.2(n) |
| Processing | Any wholly or partly automated operation on digital personal data, from collection to erasure | s.2(x) |
| Data Fiduciary | Whoever decides the purpose and means of processing: usually the business | s.2(i) |
| Data Processor | Whoever processes on a Data Fiduciary's behalf: a payroll, CRM or cloud vendor | s.2(k) |
| Data Principal | The individual the data is about; for a child, includes the parents or lawful guardian | s.2(j) |
| Child | An individual who has not completed eighteen years | s.2(f) |
| Personal data breach | Unauthorised processing, or accidental disclosure, loss or destruction, that compromises the data | s.2(u) |
| Significant Data Fiduciary | A Data Fiduciary the Central Government notifies under section 10 | s.2(z) |
| Consent Manager | A person registered with the Board through whom consent is given, managed and withdrawn | s.2(g) |
13 November 2025. The definitions commenced with the first stage. The duties that use them apply from 13 May 2027.
Under section 2(t), any data about an individual who is identifiable by or in relation to such data. The Act applies to it when it is in digital form, or is digitised later (section 3).
A Data Fiduciary determines the purpose and means of processing (section 2(i)); a Data Processor processes personal data on its behalf (section 2(k)). The duties under the Act fall on the Data Fiduciary, which remains responsible for its processors under section 8(1).
The individual the personal data relates to (section 2(j)). Where she is a child, the term includes her parents or lawful guardian; where she is a person with disability, her lawful guardian acting on her behalf.
No. The Act defines only personal data. The sensitivity of the data processed is one of the factors the Central Government weighs when notifying a Significant Data Fiduciary under section 10.
On 13 November 2025, in the first stage under notification G.S.R. 843(E). The obligations that use these definitions, sections 3 to 17 and the penalties, come into force on 13 May 2027.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.