3 Definitions of data fiduciary

Bare Act

In this Act, unless the context otherwise requires,—

Section 3(1) - Adjudicating Officer

"Adjudicating Officer" means the Adjudicating Officer appointed as such under sub-section (1) of section 62;

Section 3(2) - anonymisation

"anonymisation" in relation to personal data, means such irreversible process of transforming or converting personal data to a form in which a data principal cannot be identified, which meets the standards of irreversibility specified by the Authority;

Section 3(3) - anonymised data

"anonymised data" means data which has undergone the process of anonymisation;

Section 3(4) - Appellate Tribunal

"Appellate Tribunal" means the Tribunal established under sub-section (1) or notified under sub-section (4) of section 67;

Section 3(5) - Authority

"Authority" means the Data Protection Authority of India established under sub-section (1) of section 41;

Section 3(6) - automated means

"automated means" means any equipment capable of operating automatically in response to instructions given for the purpose of processing data;

Section 3(7) - biometric data

"biometric data" means facial images, fingerprints, iris scans, or any other similar personal data resulting from measurements or technical processing operations carried out on physical, physiological, or behavioural characteristics of a data principal, which allow or confirm the unique identification of that natural person;

Section 3(8) - child

"child" means a person who has not completed eighteen years of age;

Section 3(9) - code of practice

"code of practice" means a code of practice issued by the Authority under section 50;

"consent" means the consent referred to in section 11;

Section 3(11) - data

"data" includes a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by humans or by automated means;

Section 3(12) - data auditor

"data auditor" means an independent data auditor referred to in section 29;

Section 3(13) - data fiduciary

"data fiduciary" means any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data;

Section 3(14) - data principal

"data principal" means the natural person to whom the personal data relates;

Section 3(15) - data processor

"data processor" means any person, including the State, a company, any juristic entity or any individual, who processes personal data on behalf of a data fiduciary;

Section 3(16) - de-identification

"de-identification" means the process by which a data fiduciary or data processor may remove, or mask identifiers from personal data, or replace them with such other fictitious name or code that is unique to an individual but does not, on its own, directly identify the data principal;

Section 3(17) - disaster

"disaster" shall have the same meaning as assigned to it in clause (d) of section 2 of the Disaster Management Act, 2005;

Section 3(18) - financial data

"financial data" means any number or other personal data used to identify an account opened by, or card or payment instrument issued by a financial institution to a data principal or any personal data regarding the relationship between a financial institution and a data principal including financial status and credit history;

Section 3(19) - genetic data

"genetic data" means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the behavioural characteristics, physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;

Section 3(20) - harm

"harm" includes—

  • (i) bodily or mental injury;
  • (ii) loss, distortion or theft of identity;
  • (iii) financial loss or loss of property;
  • (iv) loss of reputation or humiliation;
  • (v) loss of employment;
  • (vi) any discriminatory treatment;
  • (vii) any subjection to blackmail or extortion;
  • (viii) any denial or withdrawal of a service, benefit or good resulting from an evaluative decision about the data principal;
  • (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; or
  • (x) any observation or surveillance that is not reasonably expected by the data principal;

Section 3(21) - health data

"health data" means the data related to the state of physical or mental health of the data principal and includes records regarding the past, present or future state of the health of such data principal, data collected in the course of registration for, or provision of health services, data associating the data principal to the provision of specific health services;

Section 3(22) - intra-group schemes

"intra-group schemes" means the schemes approved by the Authority under clause (a) of sub-section (1) of section 34;

Section 3(23) - in writing

"in writing" includes any communication in electronic format as defined in clause (r) of sub-section (1) of section 2 of the Information Technology Act, 2000;

Section 3(24) - journalistic purpose

"journalistic purpose" means any activity intended towards the dissemination through print, electronic or any other media of factual reports, analysis, opinions, views or documentaries regarding

  • (i) news, recent or current events; or
  • (ii) any other information which the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in;

Section 3(25) - notification

"notification" means a notification published in the Official Gazette and the expression "notify" shall be construed accordingly;

Section 3(26) - official identifier

"official identifier" means any number, code, or other identifier, assigned to a data principal under a law made by Parliament or any State Legislature which may be used for the purpose of verifying the identity of a data principal;

Section 3(27) - person

"person" includes—

  • (i) an individual,
  • (ii) a Hindu undivided family,
  • (iii) a company,
  • (iv) a firm,
  • (v) an association of persons or a body of individuals, whether incorporated or not,
  • (vi) the State, and
  • (vii) every artificial juridical person, not falling within any of the preceding sub-clauses;

Section 3(28) - personal data

"personal data" means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, whether online or offline, or any combination of such features with any other information, and shall include any inference drawn from such data for the purpose of profiling;

Section 3(29) - personal data breach

"personal data breach" means any unauthorised or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to, personal data that compromises the confidentiality, integrity or availability of personal data to a data principal;

Section 3(30) - prescribed

"prescribed" means prescribed by rules made under this Act;

Section 3(31) - processing

"processing" in relation to personal data, means an operation or set of operations performed on personal data, and may include operations such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination, indexing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction;

Section 3(32) - profiling

"profiling" means any form of processing of personal data that analyses or predicts aspects concerning the behaviour, attributes or interests of a data principal;

Section 3(33) - regulations

"regulations" means the regulations made by the Authority under this Act;

Section 3(34) - re-identification

"re-identification" means the process by which a data fiduciary or data processor may reverse a process of de-identification;

Section 3(35) - Schedule

"Schedule" means the Schedule appended to this Act;

Section 3(36) - sensitive personal data

"sensitive personal data" means such personal data, which may, reveal, be related to, or constitute—

  • (i) financial data;
  • (ii) health data;
  • (iii) official identifier;
  • (iv) sex life;
  • (v) sexual orientation;
  • (vi) biometric data;
  • (vii) genetic data;
  • (viii) transgender status;
  • (ix) intersex status;
  • (x) caste or tribe;
  • (xi) religious or political belief or affiliation; or
  • (xii) any other data categorised as sensitive personal data under section 15.

Explanation.— For the purposes of this clause, the expressions,—

  • (a) "intersex status" means the condition of a data principal who is—
    • (i) a combination of female or male;
    • (ii) neither wholly female nor wholly male; or
    • (iii) neither female nor male;
  • (b) "transgender status" means the condition of a data principal whose sense of gender does not match with the gender assigned to that data principal at birth, whether or not they have undergone sex reassignment surgery, hormone therapy, laser therapy, or any other similar medical procedure;

Section 3(37) - significant data fiduciary

"significant data fiduciary" means a data fiduciary classified as such under sub-section (1) of section 26;

Section 3(38) - significant harm

"significant harm" means harm that has an aggravated effect having regard to the nature of the personal data being processed, the impact, continuity, persistence or irreversibility of the harm;

Section 3(39) - State

"State" means the State as defined under article 12 of the Constitution;

Section 3(40) - systematic activity

"systematic activity" means any structured or organised activity that involves an element of planning, method, continuity or persistence.

Other Laws


Section 2(d) in the Disaster Management Act, 2005 “disaster” means a catastrophe, mishap, calamity or grave occurrence in any area, arising from natural or man made causes, or by accident or negligence which results in substantial loss of life or human suffering or damage to, and destruction of, property, or damage to, or degradation of, environment, and is of such a nature or magnitude as to be beyond the coping capacity of the community of the affected area ^[https://indiankanoon.org -- Disaster Management Act, 2005 > Section 2(d)];

electronic form

Section 2(1)(r) in The Information Technology Act, 2000 "electronic form", with reference to information, means any information generated, sent, received or stored in media, magnetic, optical, computer memory, micro film, computer generated micro fiche or similar device;


Personal Data Explanation

Definition of Personal Data is arguably the most important and widely interpreted definition in the act.

  1. The data should be about a natural person. Hence all the information about Company, Partnership Firm, Trust are out of scope.
  2. The data should directly or indirectly identify the natural person. i.e. the fact of who the person is.
  3. The data can be about
    1. "characteristic" -- a feature or quality of data serving to identify a person
    2. "trait" -- a genetically determined characteristic or a distinguishing quality belonging to a person
    3. "attribute" -- a quality or feature regarded as an inherent part of a person
  4. The act also applies to data from which inference is drawn upon for the purpose of profiling.

Profiling refers to the process of construction and application of user profiles generated by computerized data analysis ^[https://en.wikipedia.org/wiki/Profiling];

::TheFooter ::