DSCI DCPP key terms

Any information relating to an identified or identifiable natural person, directly or indirectly, by reference to an identifier such as a name, number, location, or online handle.

The individual natural person to whom personal data relates, and whose interests the Indian data protection law is designed to protect. The term is used in India instead of data subject.

The entity that alone or with others determines the purpose and means of processing personal data. It bears the primary legal obligations and accountability for lawful processing.

A person or entity that processes personal data on behalf of a data fiduciary, following its instructions, and typically bound by a written contract that sets out obligations.

A clear, affirmative, specific, informed, and unambiguous indication of the individual's wishes by which they agree to processing of their personal data, given freely and capable of withdrawal.

A principle requiring that personal data be collected for specified, explicit, and legitimate purposes and not be further processed in ways incompatible with those stated purposes.

The principle that only personal data adequate, relevant, and limited to what is necessary for the stated purpose should be collected and retained.

The rule that personal data should be kept in a form identifying individuals for no longer than is necessary for the purposes for which it was collected, after which it should be erased.

A category of personal data considered to carry higher risk if misused, such as financial information, health records, biometric data, caste or religious belief, and information about children.

The regulatory authority established under Indian data protection law to hear complaints, investigate breaches, and impose penalties for non-compliance with the law's obligations.

A designated individual responsible for advising on and monitoring compliance with data protection obligations, and acting as point of contact for regulators and data principals.

A structured evaluation of the risks to individuals arising from a processing activity, carried out before high-risk processing begins, and used to design mitigations.

An approach that embeds privacy protections into systems, processes, and product architecture from the outset, rather than adding them after deployment.

The requirement that, without user action, the most privacy-protective settings apply, so that only necessary personal data is collected and shared.

Processing that irreversibly removes identifiability so the resulting data can no longer be linked to an individual by any reasonably likely means.

Replacing direct identifiers with artificial keys so data cannot be attributed to an individual without additional information kept separately and protected.

The process of linking de-identified or pseudonymized data back to a specific individual, often by combining datasets or using auxiliary information.

A de-identification model ensuring each combination of quasi-identifiers appears for at least k individuals, so no record can be singled out from the dataset.

A mathematical privacy guarantee that adds calibrated noise so the output of a query or model changes little whether or not any single individual's data is included.

A request by an individual to confirm whether their personal data is processed and to obtain a copy, along with related information such as purposes and recipients.

An individual's right to have their personal data deleted without undue delay where specified grounds apply, such as withdrawal of consent or unlawful processing.

An individual's right to have inaccurate or incomplete personal data corrected, completed, or updated by the entity holding it.

The right to receive one's personal data in a structured, commonly used, machine-readable format and to transmit it to another service provider.

The movement of personal data from one jurisdiction to another, which typically requires a lawful transfer mechanism and adequate protection at the destination.

A formal determination by a regulator that another country or territory provides an essentially equivalent level of data protection, allowing transfers without extra safeguards.

Pre-approved model contract terms that import data protection obligations into an agreement between exporter and importer, used to legitimize international transfers.

An approved internal set of data protection policies and safeguards that allows a corporate group to transfer personal data between its entities across jurisdictions.

A legal requirement that certain categories of data be stored or processed within a country's borders, sometimes with a mirror-copy requirement.

The European Union's comprehensive data protection law, in force since 2018, setting rules on lawful processing, individual rights, transfers, and significant administrative fines.

The principle that an organization must be able to demonstrate compliance with data protection obligations, not merely state it, through records, policies, and evidence.

An inventory documenting what personal data an organization processes, why, where it is stored, who receives it, and how long it is retained.

A catalog of data assets and flows across systems, used to know where personal data resides and to support mapping, classification, and rights fulfilment.

Assigning labels such as public, internal, confidential, or restricted to data assets so that handling controls match the sensitivity and risk of the data.

The obligation to inform regulators and affected individuals about a personal data breach within prescribed timelines, typically when it creates a risk of harm.

A documented set of roles, steps, and communication paths for detecting, containing, assessing, and recovering from a privacy or security incident.

Technical methods such as encryption, secure multi-party computation, or synthetic data that reduce exposure of personal data while enabling analysis or sharing.

A lawful basis for processing personal data without consent where the law permits, such as certain state functions, legal obligations, or specified public interest purposes.

A requirement to obtain and confirm consent from a parent or lawful guardian before processing personal data of children, using reliable verification mechanisms.