Comprehensive Definitions

Converting personal data into unreadable form using mathematical algorithms so only authorised parties can read it.

Making personal data unintelligible or unclear to prevent unauthorised understanding.

Hiding parts of personal data so only limited portions are visible for authorised use.

Replacing personal data with a unique token mapped to the original data so verification is possible without revealing the actual data.

A privacy-preserving digital token issued by an authorised entity that confirms identity/age without sharing actual documents.

An entity legally empowered by the Government or law to issue verified identity/age details or virtual tokens.

A notified intermediary that stores and provides verified documents or identity details for authentication.

Any computer, system, device, software, or network as defined under the IT Act, relied on for storing or processing data.

Any online account, profile, handle, or identifier through which a Data Principal accesses a Data Fiduciary’s services.

Consent that the Data Fiduciary can reliably confirm as originating from the authorised individual (e.g., parent/guardian).

A registered entity that enables Data Principals to give, manage, review, or withdraw consent through an interoperable platform.

An entity that stores, transmits, or provides access to data on behalf of another person (as defined in the IT Act).

A person who processes personal data on behalf of a Data Fiduciary.

Technical and organisational measures (e.g., encryption, logging, access controls) to prevent personal data breaches.

Logs and metadata associated with the processing activity, retained for audit and breach-related purposes.

Digital, procedural, and legal mechanisms enabling fully online functioning of the Board or Tribunal.

Any unauthorised processing, disclosure, alteration, loss, or access to personal data.

The purpose for which personal data is collected, stated in the notice given to the Data Principal.

Any person who determines the purpose and means of processing personal data.

A Data Fiduciary designated by the Government based on volume, sensitivity, or risk factors.

The individual to whom the personal data relates.

Any operation performed on personal data, including collection, storage, use, sharing, or erasure.

Permanent deletion of personal data once purpose is met or on request unless law requires retention.

Keeping personal data for the period required for the specified purpose or as mandated by law.

The mandatory intimation sent to the Data Principal and the Board when a personal data breach occurs.

Logs tracking who accessed personal data and when, used to detect unauthorised access.

Replicated copies of personal data required for continuity during loss or compromise.

A fully virtual workspace enabling digital handling of filings, hearings, and adjudication.

The tribunal designated under the DPDP Act to hear appeals against Board decisions.