Glossary

Terms used across vDPO, most of them from India’s Digital Personal Data Protection (DPDP) Act and Rules.

Data Principal	The person the personal data is about. For a child, it includes the parent or lawful guardian.
Data Fiduciary	The organisation that decides why and how personal data is processed.
Data Processor	An organisation that processes personal data on behalf of a Data Fiduciary, under a contract.
Significant Data Fiduciary	A Data Fiduciary notified by the Government because of the volume or sensitivity of the data it processes, with extra duties such as periodic DPIAs and audits.
Consent Manager	A registered body through which people can give, manage, review and withdraw consent.
Data Protection Board of India	The authority that receives breach reports and complaints and can impose penalties under the DPDP Act.
Legitimate use	A ground for processing without consent listed in section 7 of the DPDP Act, such as data voluntarily provided for a specified purpose, a legal obligation, a medical emergency or employment.
Verifiable parental consent	Consent from the parent or lawful guardian of a child (anyone under 18), obtained in a way the DPDP Rules accept.
Personal data breach	Any unauthorised processing, accidental disclosure, loss of access, alteration or destruction of personal data.
DPIA	Data Protection Impact Assessment: an assessment of the privacy risks of a processing activity before it starts.
Grievance	A complaint from a Data Principal about how their personal data is handled, which must be answered within the period the organisation publishes.
Control	One requirement or good practice to assess for a client, tied to a law. Controls are grouped into modules.
Module and volume	vDPO’s sixteen compliance modules, such as Consent and Preference Management, grouped into volumes.
Finding	A No or Partially answer in a gap analysis or DPIA, waiting to be placed in a risk.
Practice and real clients	Fictional clients for learning, and actual organisations with their own subscription and encryption.