The DPDP Act sorts everyone into a few roles, and almost every duty attaches to one of them. The two you must place yourself in are Data Fiduciary and Data Processor: a Fiduciary decides why and how personal data is used, a Processor handles it on the Fiduciary's instructions. The person the data is about is the Data Principal. These definitions sit in Sec. 2 of the Act, and the wording below is the Act's own.
Getting the role right comes before anything else. It decides who owes the notice, who answers the complaint, and who is liable if something goes wrong.
The three core roles
Data Fiduciary, Sec. 2(i). "Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data." The test is control over the decision, not ownership of the servers. If you decide that a customer's phone number will be collected and what it will be used for, you are the Fiduciary. If two organisations decide together, both are Fiduciaries ("in conjunction with other persons").
Data Principal, Sec. 2(j). "The individual to whom the personal data relates." Two extensions matter: where the individual is a child, the term includes her parents or lawful guardian, and where she is a person with disability, it includes her lawful guardian acting on her behalf. Only individuals are Data Principals. A company's own records are not covered by this role.
Data Processor, Sec. 2(k). "Any person who processes personal data on behalf of a Data Fiduciary." A payroll bureau, a cloud host or an SMS vendor usually sits here. Using one does not move the duty: Sec. 8(1) makes the Fiduciary responsible for compliance in respect of any processing done on its behalf, irrespective of any agreement to the contrary, and Sec. 8(2) requires a valid contract before a Processor is engaged for activity related to offering goods or services to Data Principals.
Who counts as a "person"
The Act's definition of person is wide. Sec. 2(s) includes an individual, a Hindu undivided family, a company, a firm, an association of persons or a body of individuals, whether incorporated or not, the State, and every other artificial juristic person.
So a government department can be a Data Fiduciary, and so can a sole proprietor. Nothing in the definition depends on turnover or headcount. Whether the Act applies to you at all is a separate question, answered by Sec. 3 and covered in does the DPDP Act apply to my organisation.
Consent Manager
Sec. 2(g) defines a Consent Manager as "a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform."
The person must be registered with the Data Protection Board, so a vendor that merely offers a consent tool is not a Consent Manager, and the role is on the Data Principal's side (Sec. 6(8)). The full picture is in what is a Consent Manager and how to register as a Consent Manager.
Significant Data Fiduciary
Sec. 2(z) defines it as any Data Fiduciary or class of Data Fiduciaries notified by the Central Government under Sec. 10. It is a status the government confers, not one you reach by growing. Sec. 10(1) says the notification follows an assessment of relevant factors, including:
- the volume and sensitivity of personal data processed;
- risk to the rights of Data Principals;
- potential impact on the sovereignty and integrity of India;
- risk to electoral democracy;
- security of the State; and
- public order.
A notified Fiduciary must appoint a Data Protection Officer based in India and an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits under Sec. 10(2). Rule 13(1) sets the cycle at once in every period of twelve months from notification. Everyone else is outside those duties.
The other terms people trip over
Several defined terms get used loosely. The Act's meanings are narrower than everyday ones.
- Personal data, Sec. 2(t): "any data about an individual who is identifiable by or in relation to such data." There is no separate category for sensitive data.
- Processing, Sec. 2(x): a wholly or partly automated operation on digital personal data. It includes collection, storage, use, sharing and erasure, so deleting data is itself processing.
- Personal data breach, Sec. 2(u): unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises confidentiality, integrity or availability. See DPDP data breach notification for what follows.
- Specified purpose, Sec. 2(za): the purpose mentioned in the notice. Consent and later erasure are both measured against it.
- Data Protection Board, Sec. 2(c): the Data Protection Board of India, established under Sec. 18.
- Child, Sec. 2(f): an individual who has not completed eighteen years.
- Data Protection Officer, Sec. 2(l): an individual appointed by a Significant Data Fiduciary. An ordinary Fiduciary has no DPO duty, though Sec. 8(9) and Rule 9 require it to publish contact information for a person who can answer a Data Principal's questions.
One drafting point: Sec. 2(y) says "she" includes an individual irrespective of gender. The Act uses it throughout, and so does this site.
Putting the definitions to work
Start with a plain mapping exercise. For each processing activity, write down who decides the purpose, who only follows instructions, and whose data it is. The first is a Fiduciary, the second a Processor, the third a Data Principal. Where the answers differ by activity, record that too, because the roles attach to the activity.
Two outcomes follow from that map. Your contracts with every Processor need the Sec. 8(2) treatment, and your Processor list becomes the starting point for the sharing disclosures a Data Principal can ask for under Sec. 11(1)(b). The wider list of duties is in what is the DPDP Act.
For the tooling side, the processing register holds the inventory of activities, purposes and recipients that makes this mapping repeatable, and the compliance map ties each provision to a control. For what valid consent has to contain, read DPDP consent requirements.