The roles the Act defines, and who ends up in each

The Act defines twenty-eight expressions in Sec. 2 before it imposes a single duty, and five of them decide who owes what to whom. Everything else in the statute is written as an obligation of one of these roles or a right of another, so a page here is not a dictionary entry — it is the answer to “does this apply to me, and in which capacity”. Each one quotes the provision, says the same thing in a sentence that survives being repeated to a colleague, and names what the term is not.

The five, in the order they are worth reading. A Data Fiduciary is anyone who determines the purpose and means of processing personal data, under Sec. 2(i) — the role that carries almost every duty. A Data Principal is the individual the data is about, under Sec. 2(j), which for a child includes her parent or lawful guardian. A Data Processor, under Sec. 2(k), processes personal data on behalf of a Data Fiduciary and decides none of it — and Sec. 8(1) keeps the Fiduciary answerable for what it does, irrespective of any agreement to the contrary.

The last two are named rather than merely described. A Significant Data Fiduciary is a Data Fiduciary the Central Government has notified under Sec. 10, which Sec. 2(z) says in so many words; no threshold makes you one. A Consent Manager is a company registered with the Board under Sec. 2(g) and Rule 4 that acts for the Data Principal across Fiduciaries — not a platform a business buys to run its own consent, which is the distinction Consent Manager registration argues at length.

These pages are the long answers. The one-line version of each sits in the vocabulary section of the Act explained from the beginning, which is the page to read first if none of the terms are familiar yet; the provision map is the page to read if they all are.