DPDP Vocabulary Key Terms Explained

The DPDP Act 2023 uses familiar words in specific ways. "Consent", "processor" and "erasure" all carry legal meaning, and mixing them up leads to the wrong obligations.

There is a second trap. Many terms used in privacy teams, such as RoPA, DPIA or consent orchestration, are industry vocabulary, not defined by the Act. Treating them as statutory terms creates false certainty.

This guide covers the terms that matter most, and marks which ones come from the law and which come from practice.

The core terms

Term	What it means	Source
Personal data	Data about an individual who can be identified from it	DPDP Act
Digital personal data	Personal data in digital form, including data digitised later	DPDP Act
Data Principal	The individual the data relates to; for a child, includes the parent or guardian	DPDP Act
Data Fiduciary	The entity that decides the purpose and means of processing	DPDP Act
Data Processor	An entity processing data on a fiduciary's behalf; the role follows the activity, not the label	DPDP Act
Significant Data Fiduciary	A fiduciary notified by the Central Government, with extra duties such as a DPO and audits	DPDP Act
Processing	Any operation on data, from collection to erasure	DPDP Act
Specified purpose	The purpose stated in the notice given to the Data Principal	DPDP Act
Data Protection Board	The statutory body for breaches, complaints and proceedings	DPDP Act
Consent Manager	A statutory intermediary registered with the Board	DPDP Act
Consent Management Platform	Software that captures and stores consent; not the same as a Consent Manager	Industry
Consent artefact	Structured evidence of one consent transaction	Industry
Data mapping	Tracing how personal data moves through your organisation	Practice
RoPA	A record of processing activities; a GDPR idea, not a DPDP term	Practice
DPIA	A structured risk assessment; SDFs have prescribed duties of their own	Practice

Every SDF is a Data Fiduciary, but most Data Fiduciaries are not SDFs.

Consent, rights, children and breaches

Consent

Valid consent needs a clear affirmative action, such as a ticked box or a button, and it must be free, specific, informed, unconditional and unambiguous. In practice that means one purpose per request, no bundling, and no pre-ticked boxes.

Withdrawal should be about as easy as giving consent, and it must reach your processors and downstream systems. The consent lifecycle runs from request to capture, storage, validation, use, review, withdrawal and retained evidence.

Data Principal rights

The Act gives people the right to access information, correct, complete and update their data, erase it, seek grievance redressal and nominate someone to act for them after death or incapacity. Two points trip businesses up:

Erasure does not always mean immediate deletion, because other laws may require you to keep some data.
Grievance redressal needs a working mechanism, not just a contact email address.

Children's data

A child is anyone under 18. Processing children's data needs verifiable parental consent, and tracking or behavioural monitoring of children is restricted. EdTech, gaming and media businesses feel this most.

Breaches and security

A personal data breach covers loss of confidentiality, integrity or availability, including accidental disclosure. You must keep reasonable security safeguards, and report breaches to the Board and the affected Data Principals.

Privacy notice, consent notice, consent record

These are three separate things. The notice tells people what you do, the consent captures their agreement, and the record proves both happened.

Data governance terms

Before you can answer a rights request or prove consent, you need to know what data you hold. Data discovery finds personal data across your systems, data classification sorts it by type and sensitivity, and a data inventory records what you hold and why. Data lineage tracks where each piece of data came from and where it travels next.

None of these are defined in the Act, but they are the groundwork for purpose limitation, data minimisation and retention. Without them, erasure, correction and breach response all become guesswork, which is why mature teams build them first and write policies second

The takeaway

Keep three layers apart. The law sets obligations, governance turns them into policies, and technology carries them out. The biggest vocabulary mistake is mixing statutory terms with tool or industry terms.

DPDP compliance is an operating model, not a consent banner. Start with the right words, and the right processes tend to follow.