RULE 2 – Definitions

Published by the Secure Privacy Compliance Team · Last reviewed: Feb 2026

[all]

No	Description
(1)
	(a) “Act” means the Digital Personal Data Protection Act 2023 (22 of 2023)
	(b) “app” means a computer program or software application, designed to run on a mobile device
	(c) “authority” means any authority as referred to in Article 12 of the constitution
	(d) “certificate issued under government policy” shall mean a certificate issued under any policy or instruction of the Central Government or any State Government
	(e) “Computer resource” shall have the same meaning as is assigned to it in the Information Technology Act 2000 (21 of 2000)
	(f) “consent artifact” means a machine-readable electronic record, which – (i) is capable of enabling (I) a data fiduciary to give any notice referred to in these rules or to request for consent; and (II) a data principal to directly or through a consent manager acting on her behalf, give, manage, review and withdraw her consent, indicate that she does not consent to the use of personal data voluntarily provided by her for a specified purpose or exercise the rights of the Data Principal (ii) contains (I) information to enable identification of the Data Principal and Data Fiduciary (II) an itemized description of the personal data to which such notice, request for consent, withdrawal, indication or exercise of rights relates but does not contain such personal data, save for the information to enable identification of the data principal (III) a description of the specified purpose (IV) a sequence of characters to uniquely identify such electronic record; and (V) the elecronc signature of such data principal, data fiduciary and consent manager, whichever is applicable. and (iii) is consisent with the technical specifications for a consent artifact, as contained in the electronic consent framework published by the Ministry of Elecronics and Information Technology on its website
	(g)”Digital Locker Service Provider” means such intermediary, including a body corporate or an agency of the appropriate Government as may be notified by the Central Government in accordance with the rules made in this regard under the Information Technology Act, 2000 (21 of 2000)
	(h)”Electronic record” shall have the same meaning as is assigned to it in the Information Technology Act 2000 (21 of 2000)
	(i)”Electronic signature” shall have the same meaning as is assigned to it in the Information Technology Act, 2000 (21 of 2000)
	(j)”intermediary” shall have the same meaning as is assigned to it in the Information Technology Act 2000 (21 of 2000)
	(k)”Notice to inform of processing done” means a notice as referred to in sub-section (2) of Section (5)
	(l)”Notice to seek consent” means a notice as referred to in the Sub-section (1) of section 5
	(m)”Personal Data breach Intimation Artifact” means a machine-readable electronic record, which- (i) is capable of enabling a Data Fiduciary or a Consent Manager to give the Board an intimation of a personal data breach in accordance with rule 7 (ii) contains- (I) information relating to the identity of such Data Fiduciary or Consent Manager (II) a sequence of characters to uniquely identify such electronic record and (III) the electronic signature of such Data Fiduciary or Consent Manager and (iii) is consistent with such technical specifications as the Board may publish on its website under rule 19
	(n)”Request for Consent” means a request for consent under section 6
	(o)”Rights of the Data Principal”- (i) where the Data fiduciary is a person other than the State or any of its instrumentalities, means the rights conferred by Chapter III of the Act and (ii) where the data fiduciary is the State or an instrumentality of the State means the rights conferred by Chapter III of the Act other than the right of the Data Principal under Section 12 to erasure of her personal data.
	(p)”Section” shall mean a section of this act
	(q)”Service, Certificate, license or permit provided or issued under law” shall mean a service, certificate, license or permit provided or issued in exercise of any power of or the performance of any function by the State or such instrumentality under any law for the time being in force
	(r)”Standards for processing by State and its instrumentalities” means the standards referred to in sub-rule (1) of rule 6
	(s)”Subsidy, benefit or service provided using public funds” shall mean a subsidy, benefit or service for which expenditure is incurred from or the receipt there from forms part of (i) in respect of the Central Government or State Government, the consolidated fund of India or the Consolidated fund of the State or the public account of India or the public account of the State or (ii) in respect of any local or other authority within the territory of India or under the control of the Government of India, the fund or funds of such authority
	(t)”terms of service” in relation to a data principal means the terms of service by whatever name called of the Data Fiduciary or Consent Manager as the case may be for processing her personal data and
	(u)”user account” means the online account registered by the data principal with the data fiduciary and includes any profiles, pages, handles and other similar presences by means of which she is able to access the servies offered by such data fiduciary.

(2)	Words and expressions used here in and not defined in these rules, but defined in the Act shall have the meanings respectively assigned to them in the Act

Compliance Checklist — Rule 2 (Definitions)

All key legal terms used in the rules are clearly defined
Definitions are consistent with the Digital Personal Data Protection Act, 2023
Cross-references to other laws (e.g., IT Act, Constitution) are accurate
Terms like “Data Principal”, “Data Fiduciary”, and “Consent” are clearly understood
Definitions are applied consistently across all compliance documentation
Internal policies align with statutory definitions
No ambiguity exists in interpretation of defined terms