Resources
Glossary of terms
What the words mean, in plain language. Legal terms follow the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025; the reference after each one points to the source.
In the DPDP Act and Rules
- Appellate Tribunal
- The Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which hears appeals against the Board’s orders.· Act s. 2(a), 29
- Certain legitimate uses
- The limited cases where personal data may be processed without consent, such as data a person gave voluntarily for a purpose, State benefits, legal obligations, medical emergencies, disasters and some employment needs.· Act s. 7
- Child
- Anyone who has not completed 18 years of age.· Act s. 2(f)
- Consent
- Agreement that must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data needed for the specified purpose.· Act s. 6
- Consent Manager
- A company registered with the Data Protection Board that gives individuals a single place to give, manage, review and withdraw their consent, through an accessible, transparent and interoperable platform.· Act s. 2(g); Rule 4
- Data Fiduciary
- Any person or organisation that decides why and how personal data is processed, such as a bank, an app or a shop.· Act s. 2(i)
- Data Principal
- The individual the personal data is about. For a child, this includes the parent or lawful guardian; for a person with a disability, the lawful guardian acting on their behalf.· Act s. 2(j)
- Data Processor
- Anyone who processes personal data on behalf of a Data Fiduciary, for example a cloud or payroll provider. The Data Fiduciary stays responsible for it.· Act s. 2(k)
- Data Protection Board of India
- The body set up under the Act to hear complaints, inquire into personal data breaches, register Consent Managers and impose penalties. It works as a digital office.· Act s. 18, 27
- Data Protection Officer
- The person a Significant Data Fiduciary appoints in India to answer for its data protection and to be the point of contact for grievances.· Act s. 2(l), 10
- Digital personal data
- Personal data in digital form. The Act covers data collected digitally, and data collected on paper and digitised later.· Act s. 2(n), 3
- Grievance redressal
- Every Data Fiduciary and Consent Manager must answer a complaint within a period of at most 90 days. A person must use this route before going to the Board.· Act s. 13; Rule 14
- Notice
- What a Data Fiduciary must show when asking for consent: the personal data, the purpose, and how to withdraw consent, use rights and complain to the Board. It must stand on its own and be available in English or any language of the Eighth Schedule.· Act s. 5; Rule 3
- Penalty
- A fine the Board can impose for a breach of the Act. The largest, for failing to take reasonable security safeguards, may extend to ₹250 crore.· Act s. 33; Schedule
- Personal data
- Any data about an individual who can be identified by or from it, such as a name, mobile number or account number.· Act s. 2(t)
- Personal data breach
- Any unauthorised processing, or accidental disclosure, use, change, loss or destruction of personal data, that compromises its confidentiality, integrity or availability. The Board must get a detailed report within 72 hours.· Act s. 2(u); Rule 7
- Processing
- Anything done with digital personal data, wholly or partly automated: collecting, storing, using, sharing, combining or erasing it, among others.· Act s. 2(x)
- Reasonable security safeguards
- The measures a Data Fiduciary must take to prevent a breach, including encryption or masking, access control, logging and monitoring, and keeping logs for at least one year.· Act s. 8(5); Rule 6
- Right to access information
- A person can ask a Data Fiduciary for a summary of their personal data being processed, the processing done, and who else it was shared with.· Act s. 11
- Right to correction and erasure
- A person can ask for their personal data to be corrected, completed, updated or erased, unless a law requires it to be kept.· Act s. 12
- Right to nominate
- A person can name someone to exercise their rights if they die or become unable to.· Act s. 14
- Significant Data Fiduciary
- A Data Fiduciary the Central Government notifies because of the volume or sensitivity of the data it handles. It has extra duties: a Data Protection Officer in India, an independent data auditor and periodic impact assessments.· Act s. 10
- Specified purpose
- The purpose stated in the notice. Personal data may be used only for it, and must be erased once it is served, unless a law requires keeping it.· Act s. 2(za), 8(7)
- Verifiable consent
- Consent from a parent or lawful guardian that the Data Fiduciary has checked is genuine, for example against reliable identity and age details, before processing a child’s or a dependent person’s data.· Act s. 9; Rules 10–11
- Withdrawal of consent
- The right to take consent back at any time, as easily as it was given. The Data Fiduciary, and its Data Processors, must then stop processing within a reasonable time.· Act s. 6(4)–(6)
On myconsentapp
- Consent record
- The entry created when a person grants, changes or withdraws a consent: which company, which purpose, which notice version, the status and the dates. It holds no business data about the person.
- ECDSA P-256
- The digital signature that every browser, phone and standard library can verify today. Every consent event carries one.
- Envelope encryption
- Personal data is encrypted with a data key, and that key is itself encrypted with a master key in the key management service: two layers of keys.
- Hash chain
- Each ledger entry includes a fingerprint (SHA-256 hash) of the one before it, so changing any past entry breaks every link after it and is detected.
- Interoperability
- Letting a person see and withdraw consents held by another Consent Manager from one place, only with their explicit permission. Today it is demonstrated against a simulated Consent Manager.
- JWKS
- A published set of public keys (JSON Web Key Set). We publish ours so anyone can check our signatures.
- KMS / HSM
- A key management service, backed by hardware security modules. Our signing and encryption keys are created and used inside them and never leave.
- Ledger
- The append-only log of every consent event. Entries can be added but never changed or deleted.
- Merkle anchor
- A single fingerprint covering a batch of ledger entries, stored where it cannot be altered (write-once storage for seven years), so the ledger can be checked against it later.
- ML-DSA-65
- The NIST post-quantum signature standard (FIPS 204). Every consent event carries one alongside ECDSA, so records stay trustworthy if quantum computers break ECDSA.
- Post-quantum
- Cryptography designed to resist attacks by a future quantum computer.
- Sandbox
- A free test environment with test data, where a business can try the full consent flow and integrate before going live.
- Signed receipt
- A copy of a consent record, as JSON or PDF with a QR code, carrying digital signatures. Anyone can check it on the public verification page or offline, without trusting us.
- Webhook
- A signed message we send to a business’s system the moment something changes, for example when a person withdraws a consent.
No term matches your search.
This glossary explains terms in simple words and is not legal advice. Where it differs from the Act or the Rules, the official text prevails.