Key definitions under Section 2: "Consent Manager" means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform. "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data. "Data Principal" means the individual to whom the personal data relates. "Data Processor" means any person who processes personal data on behalf of a Data Fiduciary. "personal data" means any data about an individual who is identifiable by or in relation to such data. "processing" in relation to personal data means a wholly or partly automated operation or set of operations performed on digital personal data, and includes collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction. "Significant Data Fiduciary" means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 2 contains 28 defined terms that apply throughout the Act. Unlike GDPR, the DPDP Act uses India-native vocabulary throughout — Data Principal (not "data subject"), Data Fiduciary (not "data controller"), Consent Manager (a new regulated role unique to India's framework). Getting these definitions wrong has downstream consequences: a business that misidentifies itself as a Data Processor when it is actually a Data Fiduciary misses the entire compliance obligation stack in Chapter II.
A marketing SaaS company that processes customer data on behalf of its clients and determines which data fields to collect, how long to store them, and what analytics to run is likely a Data Fiduciary — not merely a Data Processor — because it determines the means of processing. If it also determines the purpose, it is unambiguously a Data Fiduciary with the full Chapter II obligation stack.
The Act's definition of 'personal data' includes any data about an individually identifiable person. There is no separate 'sensitive personal data' tier in the DPDP Act (unlike PDPA Singapore or GDPR). A person's name combined with their employer is personal data. A device ID that can be linked back to an individual is personal data. The test is identifiability, not inherent sensitivity.
A Consent Manager is a registered entity that sits between Data Principals and Data Fiduciaries — giving Data Principals a single dashboard to manage consent across multiple Fiduciaries. This role did not exist in Indian law before the DPDP Act. truConsent is applying for Consent Manager registration when the Board opens the process.