DPDP reference

Section 2: Definitions

Last checked 6 Nov 2026

This section gives the Act its vocabulary. A Data Fiduciary decides the purpose and means of processing, alone or with others (s.2(i)). A Data Processor processes personal data on a Data Fiduciary's behalf (s.2(k)). A Data Principal is the individual the data relates to, and for a child includes the parents or lawful guardian (s.2(j)).

Personal data is any data about an individual who is identifiable by or in relation to that data (s.2(t)). A child is an individual who has not completed eighteen years (s.2(f)). A personal data breach covers unauthorised processing and accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability (s.2(u)).

Processing means a wholly or partly automated operation on digital personal data, including collection, storage, use, sharing and erasure (s.2(x)). A person includes an individual, a Hindu undivided family, a company, a firm, an association of persons, the State and every artificial juristic person (s.2(s)).

Applies to
Everyone reading the Act. The defined words decide who carries each duty.
Starts
13 Nov 2025, in force (G.S.R. 843(E), item (a)).
Penalty
None of its own. This section sets out how the law works and places no duty on a business.
Source
Digital Personal Data Protection Act, 2023 (22 of 2023), section 2; G.S.R. 843(E), commencement

Questions

Who is a Data Fiduciary under the DPDP Act?

Any person who, alone or with others, decides the purpose and means of processing personal data (s.2(i)). Person includes companies, firms and individuals (s.2(s)).

What age is a child under the DPDP Act?

An individual who has not completed the age of eighteen years (s.2(f)).

Related

Next

Join early access

Not legal advice.