Section 2 of Digital Personal Data Protection Act, 2023 - Definitions

Section 2 of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) contains the principal definitions used throughout India's digital personal data protection law. These definitions determine how key expressions such as personal data, processing, Data Fiduciary, Data Principal, Consent Manager and personal data breach are understood under the Act.

Current legal status: Section 2 came into force on 13 November 2025 under the Central Government commencement notification. The Digital Personal Data Protection Rules, 2025 were also notified in November 2025, with different rules taking effect on the phased dates specified in rule 1.

Section 2 - Statutory definitions

Unless the context otherwise requires, Section 2 defines the following expressions:

(a) Appellate Tribunal: the Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997.
(b) automated: any digital process capable of operating automatically in response to instructions given or otherwise for the purpose of processing data.
(c) Board: the Data Protection Board of India established by the Central Government under section 18.
(d) certain legitimate uses: the uses referred to in section 7.
(e) Chairperson: the Chairperson of the Board.
(f) child: an individual who has not completed the age of eighteen years.
(g) Consent Manager: a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
(h) data: a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means.
(i) Data Fiduciary: any person who alone or in conjunction with other persons determines the purpose and means of processing personal data.
(j) Data Principal: the individual to whom the personal data relates. Where that individual is a child, the expression includes the parents or lawful guardian of the child; where the individual is a person with disability, it includes the lawful guardian acting on her behalf.
(k) Data Processor: any person who processes personal data on behalf of a Data Fiduciary.
(l) Data Protection Officer: an individual appointed by the Significant Data Fiduciary under section 10(2)(a).
(m) digital office: an office adopting an online mechanism in which proceedings, from receipt of an intimation, complaint, reference, direction or appeal through disposal, are conducted online or in digital mode.
(n) digital personal data: personal data in digital form.
(o) gain: a gain in property or supply of services, whether temporary or permanent, or an opportunity to earn remuneration, greater remuneration or another financial advantage otherwise than by legitimate remuneration.
(p) loss: a loss in property or interruption in supply of services, whether temporary or permanent, or loss of an opportunity to earn remuneration, greater remuneration or another financial advantage otherwise than by legitimate remuneration.
(q) Member: a Member of the Board, including the Chairperson.
(r) notification: a notification published in the Official Gazette; the expressions notify and notified are construed accordingly.
(s) person: includes an individual, Hindu undivided family, company, firm, association of persons or body of individuals whether incorporated or not, the State, and every artificial juristic person not falling within the preceding categories.
(t) personal data: any data about an individual who is identifiable by or in relation to such data.
(u) personal data breach: unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data.
(v) prescribed: prescribed by rules made under the Act.
(w) proceeding: any action taken by the Board under the provisions of the Act.
(x) processing: a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
(y) she: in relation to an individual, includes a reference to that individual irrespective of gender.
(z) Significant Data Fiduciary: a Data Fiduciary or class of Data Fiduciaries notified by the Central Government under section 10.
(za) specified purpose: the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the Act and the rules made under it.
(zb) State: the State as defined in article 12 of the Constitution of India.

Meaning and importance of key terms

Personal data and digital personal data

The Act focuses on data about an identifiable individual. The expression digital personal data narrows this to personal data in digital form. These definitions should be read with section 3 on application of the Act.

Data Fiduciary, Data Principal and Data Processor

A Data Fiduciary decides the purpose and means of processing personal data. A Data Principal is the individual to whom the data relates. A Data Processor processes personal data on behalf of a Data Fiduciary. These roles are central to the obligations and rights created by the Act.

Processing and personal data breach

The definition of processing is broad and covers the life cycle of digital personal data, from collection and storage through use, sharing, restriction, erasure and destruction. A personal data breach includes unauthorised processing and specified accidental events where confidentiality, integrity or availability is compromised.

Child and Consent Manager

For the Act, a child is an individual below eighteen years of age. A Consent Manager is a Board-registered person providing an accessible, transparent and interoperable platform through which a Data Principal can manage consent. The detailed regulatory framework must be read with the Digital Personal Data Protection Rules, 2025 as and when the relevant provisions are in force.

Legal update: Because the Act and the 2025 Rules have phased commencement provisions, readers should check the applicable commencement date before relying on a substantive obligation, right or procedure. Section 2 itself is already in force.

Official legal resources

For the authoritative statutory text and current notifications, refer to India Code - Digital Personal Data Protection Act, 2023 and the Ministry of Electronics and Information Technology - Digital Personal Data Protection Rules, 2025.

This page is an informational guide to Section 2. In case of any difference, the text published in the Official Gazette and the applicable statutory notifications prevail.