Module 2: Key Definitions & Roles
Learn the vocabulary of the Act: who is a Data Principal, Data Fiduciary, Data Processor or Significant Data Fiduciary, and what counts as personal data and a breach. This DPDPA 2023 course page explains key definitions and roles in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Module 2 lessons (about 3 hours) (key definitions and roles)
Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.
What you will learn about key definitions and roles
- Define personal data and personal data breach
- Tell a Data Fiduciary from a Data Processor
- Recognise Consent Managers and Significant Data Fiduciaries
- Map roles in a real business scenario
The cast of characters
Every obligation in the Act attaches to a role, so getting roles right comes first.
- Data Principal: the individual the data is about (for a child, includes the parent or lawful guardian)
- Data Fiduciary: decides the purpose and means of processing
- Data Processor: processes on behalf of a fiduciary
- Significant Data Fiduciary (SDF): notified by the Government based on volume, sensitivity and risk
- Consent Manager: registered platform that lets principals give, manage and withdraw consent
- Board: the Data Protection Board of India
What is personal data? (key definitions and roles)
Any data about an individual who is identifiable by or in relation to that data. Names, phone numbers, device IDs, location and photos can all qualify when they identify someone.
What is a personal data breach?
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises confidentiality, integrity or availability.
Role mapping examples (key definitions and roles)
A bank deciding how to use customer data is a fiduciary. A payroll SaaS vendor handling the employer’s data on instruction is a processor. The fiduciary stays accountable even when a processor does the work.
Whoever decides why and how data is processed is the Data Fiduciary, and remains accountable for its processors.
Check your understanding of key definitions and roles
Q1. Who decides the purpose and means of processing?
Q2. For a child, who exercises the rights of the Data Principal?
Q3. A vendor processes data for you under a contract. Who is accountable to the Data Principal?
Quick FAQs
Can one company be both fiduciary and processor?
Yes, depending on the activity. It is a fiduciary for its own customer data and may be a processor for a client’s data.
What makes a fiduciary “significant”?
The Government notifies SDFs based on volume and sensitivity of data, risk to rights, impact on sovereignty, electoral democracy, security and public order.
Do it yourself: practical guides (key definitions and roles)
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.