DPDP reference
Glossary
Every term the Act turns on.
26 terms, each defined in one sentence, cited to the section or rule it comes from, with the questions people actually ask and, where one exists, the scanner check that tests for it on a website.
- Breach intimations.8
- Breach intimation is the duty under Section 8(6) to inform the Data Protection Board and every affected Data Principal of a personal data breach, on the clocks Rule 7 sets.
- Childs.2 · scanner check
- A child under the DPDP Act is any individual who has not completed eighteen years of age, and processing a child’s personal data requires verifiable consent from a parent or lawful guardian.
- Consents.6 · scanner check
- Consent under Section 6 must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data needed for the specified purpose.
- Consent Managers.2
- A Consent Manager is a person registered with the Data Protection Board that acts as a single point through which a Data Principal can give, manage, review and withdraw consent, on an accessible, transparent and interoperable platform.
- Cross-border transfers.16 · scanner check
- Section 16 allows personal data to be transferred outside India except to countries the Central Government restricts by notification, and preserves any stricter rule in another law.
- Data Fiduciarys.2
- A Data Fiduciary is any person who, alone or with others, decides the purpose and the means of processing personal data; it is the party the Act holds responsible.
- Data Principals.2
- The Data Principal is the individual the personal data is about; for a child it includes the parent or lawful guardian, and for a person with disability it includes the lawful guardian.
- Data Processors.8 · scanner check
- A Data Processor is any person who processes personal data on behalf of a Data Fiduciary, and may do so only under a valid contract.
- Data Protection Board of Indias.18
- The Data Protection Board of India is the body established under Section 18 that receives breach intimations and complaints, inquires into them, directs remedial measures and imposes the penalties in the Schedule.
- Data Protection Impact Assessments.10
- A Data Protection Impact Assessment is the process a Significant Data Fiduciary must carry out under Section 10 and Rule 13 every twelve months, describing the rights of Data Principals, the purpose of processing, the risks, and the measures to manage them.
- Data Protection Officers.10 · scanner check
- A Data Protection Officer is the individual a Significant Data Fiduciary must appoint under Section 10 to represent it under the Act, based in India and answerable to its board.
- Digital personal datas.2
- Digital personal data is personal data in digital form, which is the only form the DPDP Act regulates.
- Grievance redressals.8 · scanner check
- Every Data Fiduciary must publish a contact under Section 8(9), establish an effective grievance mechanism under Section 8(10), and answer within the period Rule 14 sets, which is at most ninety days.
- Legitimate usess.7
- Section 7 lists the only situations in which personal data may be processed without consent, from data an individual provides voluntarily to employment, medical emergencies and State functions.
- Notices.5 · scanner check
- A notice under Section 5 is the document that must accompany or precede every request for consent, stating the personal data and the purpose, how to exercise rights, and how to complain to the Board.
- PenaltiesSch.
- The Schedule to the DPDP Act sets seven penalty bands the Board may impose under Section 33, up to Rs 250 crore for failing reasonable security safeguards, Rs 200 crore for breach intimation and children’s data failures, and Rs 50 crore for other Data Fiduciary duties.
- Personal datas.2 · scanner check
- Under the DPDP Act, personal data is any data about an individual who can be identified by that data or in relation to it.
- Personal data breachs.2
- A personal data breach is any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability.
- Processings.2
- Processing means any wholly or partly automated operation on digital personal data, from collecting and storing it through sharing and using it to erasing and destroying it.
- Reasonable security safeguardss.8 · scanner check
- Section 8(5) requires every Data Fiduciary to protect personal data with reasonable security safeguards to prevent a breach, and Rule 6 turns that into a minimum checklist.
- Retention and erasures.8
- Personal data may be kept only while consent stands and the specified purpose is being served; Section 8(7) and Rule 8 then require erasure, with a forty-eight hour warning before data is erased for non-use.
- Right to erasures.12
- Section 12 gives a Data Principal the right to have personal data erased, and Section 8(7) separately requires a Data Fiduciary to erase it once consent is withdrawn or the specified purpose is no longer served.
- Significant Data Fiduciarys.10
- A Significant Data Fiduciary is a Data Fiduciary, or a class of them, that the Central Government notifies as significant because of the volume and sensitivity of the data it handles and the risk it poses.
- Specified purposes.2
- The specified purpose is the purpose stated in the notice given to the Data Principal, and it is the boundary of what the personal data may be used for.
- Verifiable consents.9 · scanner check
- Verifiable consent is the parental or guardian consent Section 9 requires before a child’s personal data is processed, obtained through measures that confirm the consenting person is an identifiable adult.
- Withdrawal of consents.6
- A Data Principal may withdraw consent at any time, and Section 6(4) requires withdrawing it to be as easy as giving it was.