Chapter I · Preliminary
Section 2: Definitions
Section 2 is the dictionary of the Act. The defined terms here, Data Fiduciary, Data Principal, personal data, processing and the rest, decide who carries which duty, so the whole Act reads through them.
- Chapter
- Chapter I · Preliminary
- Status
- In force
- Effective
- 13 November 2025
- Applies to
- Everyone (framework)
- Official citation
- DPDP Act, 2023, s.2
- Reading time
- 5 min
- Updated
- August 2026
At a glance
Section 2 sets out the definitions used throughout the DPDP Act, 2023. The pivotal ones are Data Fiduciary (who decides why and how data is processed), Data Principal (the individual the data is about), Data Processor (who processes on a Fiduciary's behalf), personal data (any data about an identifiable individual) and processing (almost anything you can do with data). Getting these straight is the first step in any compliance plan. The definitions in Section 2 are already in force, having commenced on 13 November 2025.
Key takeaways
- A Data Fiduciary is whoever decides the purpose and means of processing, this is usually your organisation.
- A Data Principal is the individual the data is about; for a child it includes the parent or lawful guardian.
- A Data Processor processes personal data on a Data Fiduciary's behalf, for example a cloud or payroll vendor.
- Personal data is any data about an individual who is identifiable by or in relation to that data.
- Processing is defined very broadly: collection, storage, use, sharing, erasure and almost everything in between.
- The Act covers digital personal data, data in digital form, or non-digital data later digitised.
Who should read this
Read this before anything else in the Act. Every obligation is phrased in terms of these defined roles, so knowing whether you are a Data Fiduciary or a Data Processor for a given dataset tells you which duties land on you.
In plain language
The Act works by assigning duties to named roles. The organisation that decides why and how personal data is processed is the Data Fiduciary, and it carries most of the obligations. The individual the data is about is the Data Principal. Anyone who processes data on the Fiduciary's behalf, such as a SaaS tool or an outsourced vendor, is a Data Processor.
Personal data is defined widely: any data about an individual who is identifiable by or in relation to it. Processing is defined even more widely, covering collection, recording, storage, use, sharing, disclosure, erasure and more, whether or not it is automated. In practice, almost anything you do with a person's data is processing.
One boundary matters: the Act is about digital personal data. It applies to data collected in digital form, and to data collected on paper that is later digitised. Purely offline, never-digitised records sit outside its scope. The full set of defined terms lives in our DPDP glossary.
The text of the law
Section 2: Definitions (selected)
Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
Data Principal means the individual to whom the personal data relates and where such individual is a child includes the parents or lawful guardian; and where such individual is a person with disability includes her lawful guardian.
Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
Personal data means any data about an individual who is identifiable by or in relation to such data.
Processing means a wholly or partly automated operation or set of operations performed on digital personal data, and includes collection, recording, storage, use, sharing, disclosure, erasure and similar operations.
These are selected definitions, condensed for readability; Section 2 defines many more terms. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Work out, for each dataset, whether you are the Data Fiduciary or a Data Processor, the answer decides your duties.
- Assume almost everything you do with personal data counts as processing under the Act.
- Map where you hold personal data in digital form, that is what the Act reaches.
- Use the defined terms consistently in your notice, contracts and internal policies.
Frequently asked questions
Am I a Data Fiduciary or a Data Processor?
What counts as personal data?
Does the Act cover paper records?
Where can I find every defined term?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.