InfraVeritas360DPDPiq

DPDP Insights › Glossary

DPDP glossary

The words you will hear in any DPDP conversation, explained in plain English.

Access control

Rules about who can see or change which data.

Accountability

Being able to show who is responsible for each duty, and that it was done.

Backups

Copies of data kept for recovery; they hold personal data too.

Breach intimation

Informing affected people and the Data Protection Board about a personal data breach.

Children's data

Data of anyone under 18; needs verifiable consent of a parent or lawful guardian, with some exemptions.

Consent

A person's clear agreement to a specific use of their data, which they can withdraw.

Consent Manager

A registered entity through which people can give, manage and withdraw consent; rules start on 13 November 2026.

Data Fiduciary

The organisation that decides why and how personal data is used.

Data Principal

The person the data is about: a customer, patient, citizen, employee or student.

Data Processor

An organisation that handles personal data on behalf of a Data Fiduciary, such as a cloud or payroll vendor.

Data Protection Board

The body set up under the Act to handle complaints, breaches and inquiries.

Erasure

Deleting personal data so it can no longer be used.

Evidence

Proof that something was done: a record, a log, a signed contract, a dated notice.

Grievance redressal

The process for handling complaints, within 90 days at most.

Legitimate use

A use the Act allows without consent, listed in Section 7.

Logs

System records of who did what and when; kept for at least one year.

Notice

The plain-language message telling people what data is taken and why.

Personal data breach

Any unauthorised processing, accidental disclosure, loss of access or destruction of personal data.

Reasonable security safeguards

Protective measures such as encryption, access control, logs and backups.

Retention

How long personal data is kept before it is deleted.

Second Schedule

Standards the State must follow when processing data for subsidies, benefits, services, licences and permits.

Significant Data Fiduciary

An organisation notified by the government for extra duties because of the volume or sensitivity of its data.

State

Has the meaning in Article 12 of the Constitution; covers government and many public bodies.

Third Schedule

Classes of large platforms that must erase data of users inactive for three years.

Withdrawal

Taking back consent; it must be as easy as giving it.