Key definitions you must know

The Act lives or dies in its definitions. Eight terms determine whether you are bound, what you are bound to do, and to whom.

Free preview 10 min read Verified

Legal basis

DPDP Act 2023 (No. 22 of 2023) + DPDP Rules 2025 (G.S.R. 843(E)-846(E), notified 13 November 2025)

Statute reading is, more than anything, definition reading. The DPDP Act's Section 2 contains all the defined terms. Get these eight wrong and the rest of the course will not make sense. Get them right and most of the Act follows logically. 1. Personal data "personal data" means any data about an individual who is identifiable by or in relation to such data [L3-C1]. This definition is wider than it looks. It is not limited to obvious identifiers like name or email. It includes anything that, in combination with other…

Free The rest of Module 1 is free with your email

Keep reading, free

Add your name and email. We send a one-click link that brings you straight back to this lesson, signed in. No password, no payment.

We use your name and email only to send your access link and course emails. Unsubscribe from any email at any time. Privacy notice.

Already signed up? Get a fresh link.

Every claim in this lesson is cited. Yellow markers like [L1-C1] are clickable. Click any to see the verbatim text of the Section, Rule or judgment we're relying on. Learn how we verify content ›

Citations

DPDP Act 2023, Section 2 (Definitions) L3-C8

Defines key terms including Data Principal, Data Fiduciary, Data Processor, personal data, personal data breach, processing, Significant Data Fiduciary, Consent Manager, child, and Board.

DPDP Rules 2025, Rule 4 (Registration and obligations of Consent Manager) L3-C7

A person may apply to the Board for registration as a Consent Manager if it fulfils the conditions in Part A of the First Schedule (Indian company, net worth at least two crore rupees, technical/operational/financial capability, no conflict of interest, etc.). A registered Consent Manager shall comply with the obligations in Part B (data-blind pipe, ≥7-year consent-log retention, interoperability, audit, security). Rule 4 commences 13 November 2026.

Free preview

The first lesson is open. Add your email to read the rest of Module 1 free.

Module 1: DPDPA 101: Why this law, why now

Module 2: The Five Players

The Data Principal
The Data Fiduciary
The Data Processor
Significant Data Fiduciary and Consent Manager

Module 3: Data Principal Rights

Right to access information about personal data (Section 11)
Right to correction and erasure (Section 12)
Right of grievance redressal (Section 13)
Right to nominate (Section 14)
Duties of Data Principal (Section 15)

Module 4: Data Fiduciary Obligations

Lawful grounds for processing (Section 4)
Notice (Section 5 and Rule 3)
Certain legitimate uses (Section 7)
General obligations: security, breach, erasure, DPO contact (Section 8)
Children's data (Section 9 and Rule 10)

Module 5: Implementation Toolkit

Data mapping
Record of Processing Activities (RoPA)
Consent architecture
Breach response runbook
Retention design

Module 6: SDF, DPIA and DPO

Becoming a Significant Data Fiduciary
The Data Protection Officer
Data Protection Impact Assessment
Independent audit and algorithmic diligence

Module 7: Enforcement and Penalties

The Data Protection Board of India
The Schedule penalty matrix
Handling a Board inquiry
Voluntary undertakings, ADR, and the appeals path

Module 8: AI, sectoral overlays and DPDPA

The AI lifecycle under DPDPA
Data minimisation for AI systems
Notice and consent design for AI
Fairness, bias, and explainability
EU AI Act risk tiers mapped to DPDPA
Machine unlearning and the right to erasure
RBI Data Governance Framework for BFSI (July 2026 draft)