Section 2
Definitions
Defines the terms the whole Act turns on, including who counts as a child, a Data Fiduciary and a Data Processor.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (f)
- A child is an individual who has not completed eighteen years of age.
- (g)
- A Consent Manager is a person registered with the Board who acts as a single point of contact through which a Data Principal can give, manage, review and withdraw consent, on an accessible, transparent and interoperable platform.
- (i)
- A Data Fiduciary is any person who, alone or with others, determines the purpose and means of processing personal data.
- (j)
- A Data Principal is the individual the personal data relates to. For a child this includes the parents or lawful guardian; for a person with disability it includes her lawful guardian.
- (k)
- A Data Processor is any person who processes personal data on behalf of a Data Fiduciary.
- (l)
- A Data Protection Officer is the individual a Significant Data Fiduciary appoints under s.10(2)(a).
- (n)
- Digital personal data is personal data in digital form.
- (t)
- Personal data is any data about an individual who is identifiable by or in relation to that data.
- (u)
- A personal data breach is any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises confidentiality, integrity or availability.
- (x)
- Processing covers wholly or partly automated operations on digital personal data: collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, dissemination, restriction, erasure and destruction.
- (z)
- A Significant Data Fiduciary is any Data Fiduciary, or class of them, notified as such by the Central Government under s.10.
- (za)
- The specified purpose is the purpose stated in the notice the Data Fiduciary gives the Data Principal.
In practice
The definition that catches most Indian businesses off guard is (f). A child is anyone under eighteen, not under thirteen and not under sixteen, so a product built to the American or European threshold is already outside the Indian one.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 2 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.