Key definitions that change how you design systems

Definitions that matter in practice

Personal data — any data about an individual who is identifiable by or in relation to such data. There is no separate "sensitive personal data" category in the Act (unlike SPDI Rules 2011 or GDPR). Everything identifiable is in scope, and the risk-based duties (SDF status, children's data) supply the extra protection.

Processing — a wholly or partly automated operation on digital personal data: collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, indexing, sharing, disclosure, dissemination, restriction, erasure or destruction. If your system touches personal data, it is processing.

Consent — must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, limited to the specified purpose and to personal data necessary for that purpose. Pre-ticked boxes, bundled consent and "by continuing you agree" fail this test.

Consent Manager — a Board-registered entity that lets a Data Principal give, manage, review and withdraw consent through an interoperable platform. Think of it as the DEPA/account-aggregator pattern applied to consent.

Certain legitimate uses — situations where consent is not required (Module 3).

Data Protection Officer (DPO) — mandatory for SDFs; must be based in India and be the point of contact for the grievance mechanism.

Person — includes individuals, HUFs, companies, firms, associations, the State and every juristic person. NGOs, trusts and government departments are Fiduciaries too.

Words the Act uses that you should mirror in policy

• Purpose — you will have to describe it in the notice, so define it as you build.
• Specified purpose — the purpose stated in the notice; data can only be used for it.
• Reasonable security safeguards — undefined in the Act; the Rules list minimums (encryption/obfuscation/masking, access control, logging and monitoring, backups, and a contractual flow-down to Processors).
• Personal data breach — any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access that compromises confidentiality, integrity or availability. Ransomware that only encrypts is still a breach.

Design implications

• Build a data inventory keyed by purpose, not by database.
• Log the consent event (what was shown, what was ticked, when, by whom) — it is your evidence.
• Treat availability incidents as reportable breaches in your IR runbook.