DPDP Act glossary

Child

Section 2(f)

A person who has not completed 18 years of age. Processing a child's personal data needs verifiable consent from a parent or lawful guardian.

In practice: Students in classes 11 and 12 are usually still children under the Act.

Commencement dates

Timeline

The Act was notified in stages on 13 November 2025. The Data Protection Board and framework provisions applied from that day; Consent Manager registration applies from 13 November 2026; the main duties, including notice, consent, children's data, security, breach reporting, rights and penalties, apply from 13 May 2027.

Consent

Section 6

A Data Principal's free, specific, informed, unconditional and unambiguous agreement, given by a clear affirmative action, to processing for a specified purpose and limited to the data needed for it. It can be withdrawn at any time, as easily as it was given.

In practice: Consent to an internal photo album does not cover posting the same photo on social media.

Consent Manager

Section 6(7) to 6(9), Rule 4

A person registered with the Data Protection Board who gives Data Principals a single, interoperable platform to give, manage, review and withdraw consent. Consent Managers act on behalf of, and are accountable to, the Data Principal. Registration applies from 13 November 2026. Using a Consent Manager is optional for a Data Fiduciary.

Data Fiduciary

Section 2(i)

The person or organisation that, alone or with others, decides the purpose and means of processing personal data. The fiduciary carries the duties under the Act, including for what its processors do.

In practice: For school event photos this is usually the school, not the photographer.

Data Principal

Section 2(j)

The individual the personal data relates to. For a child, it includes the parent or lawful guardian; for a person with a disability, their lawful guardian acting on their behalf.

Data Processor

Section 2(k)

Any person who processes personal data on behalf of a Data Fiduciary. A fiduciary may engage a processor only under a valid contract (Section 8(2)).

In practice: Gallery platforms, cloud drives, editing studios and contracted photographers are usually processors.

Data Protection Board of India

The body set up under the Act to inquire into breaches, direct remedies and impose penalties up to the maximums in the Schedule. The provisions that set it up came into force on 13 November 2025. No inquiries or penalties are publicly known as of November 2026.

Data Protection Officer

Section 10

An officer based in India whom a Significant Data Fiduciary must appoint as the point of contact for grievances. Other fiduciaries need only publish the contact details of a DPO, if they have one, or of a person who can answer questions about processing (Section 8(9)).

Digital personal data

Section 3

The Act applies to personal data collected in digital form, and to data collected in non-digital form that is digitised later. A printed photo scanned into a school system is covered from the moment it is digitised.

Erasure

Section 8(7), Section 12

A fiduciary must erase personal data, and make its processors erase it, when consent is withdrawn or the specified purpose is no longer being served, unless a law requires it to be kept. A Data Principal can also ask for erasure.

In practice: Erasure covers the copies you and your vendors control, not copies other people have already downloaded.

Grievance redressal

Section 8(10), Section 13

Every fiduciary must run an effective way for people to raise grievances, and must respond within the period set by the DPDP Rules, 2025. A person must use this route before complaining to the Board.

Legitimate use

Section 7

One of nine specific situations in which personal data can be processed without consent, such as data voluntarily provided for a specified purpose, legal obligations, medical emergencies, and certain employment purposes. It is a closed list. There is no general "legitimate interest" ground.

Notice

Section 5, Rule 3

Information given with or before a consent request: an itemised description of the personal data and the specified purposes, how to withdraw consent, how to raise a grievance and how to complain to the Board. It must be understandable on its own, and available in English or any Eighth Schedule language.

Penalties

Section 33, Schedule

Civil penalties imposed by the Board after an inquiry, up to the maximums in the Schedule: ₹250 crore for failing to take reasonable security safeguards, ₹200 crore each for failing to notify a breach or breaching children's-data duties, ₹150 crore for Significant Data Fiduciary duties, ₹50 crore for other breaches and ₹10,000 for a Data Principal's own duties. They are ceilings, not amounts per photo or per person.

Personal data

Section 2

Any data about an individual who is identifiable by or in relation to that data. A photograph or video of a recognisable person is personal data; so can be a bib number, name tag or caption that identifies someone.

Personal data breach

Section 8(6), Rule 7

Unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. The fiduciary must inform the Board and each affected person; Rule 7 requires a detailed report to the Board within 72 hours.

In practice: A public link to a private event gallery that was meant to be restricted can be a breach.

Purely personal or domestic purpose

Section 3(c)(i)

Processing by an individual for a purely personal or domestic purpose is outside the Act. A family's own wedding album is excluded; a studio reusing the same photos in its portfolio is not.

Reasonable security safeguards

Section 8(5), Rule 6

Measures a fiduciary must take to prevent breaches, including its processors' processing. Rule 6 lists encryption, masking or tokens, access control, logs and monitoring, backups, keeping logs for at least one year, and security terms in processor contracts.

Rights of the Data Principal

Sections 11 to 14

The right to a summary of personal data and processing and of who it was shared with; to correction, completion, updating and erasure; to grievance redressal; and to nominate someone to exercise rights on death or incapacity.

Significant Data Fiduciary

Section 10

A fiduciary, or class of fiduciaries, notified by the Central Government based on factors such as the volume and sensitivity of data and the risk to people's rights. It must appoint a Data Protection Officer and an independent data auditor and carry out periodic Data Protection Impact Assessments.

Specified purpose

Section 2

The purpose mentioned in the notice given to the Data Principal. Consent and the Section 7(a) legitimate use are both limited to the specified purpose, so "any purpose" wording does not work.

Verifiable parental consent

Section 9(1), Rule 10

Consent from a parent or lawful guardian whose identity as an adult the fiduciary has checked with due diligence, for example against reliable identity details it already holds or a virtual token such as one issued through DigiLocker. Rule 12 and the Fourth Schedule exempt some classes, such as educational institutions, only for specified purposes; publicity is not one of them.