Glossary
What the words mean
Plain-language definitions for the DPDP terms and result statuses this product uses. These explain our terminology; they are not legal advice and do not replace the Act or the Rules.
DPDP terms
Vocabulary from the Digital Personal Data Protection Act and its Rules.
- Data principalThe person the data is about.
- Under the DPDP Act, the individual whose personal data is being processed. In most other privacy laws this role is called the “data subject”. If a child's data is involved, the parent or lawful guardian acts for them.
- Data fiduciaryWhoever decides why and how the data is used.
- The organisation that determines the purpose and means of processing. This is the role most assessments are carried out for. Elsewhere it is usually called the “data controller”. Deciding the purpose is what makes you a fiduciary — not whether you hold the data.
- Data processorWhoever handles the data on someone else's instructions.
- An organisation processing personal data on behalf of a data fiduciary, and only as instructed. Your hosting provider, payroll vendor or analytics tool is typically a processor. A processor becomes a fiduciary the moment it starts deciding purposes of its own.
- Significant data fiduciaryA fiduciary the government has designated as higher-risk.
- A class of data fiduciary notified by the government based on volume and sensitivity of data, risk to data principals, and impact on public order or the sovereignty and integrity of India. Designation brings extra duties, including a Data Protection Officer based in India, an independent data auditor and periodic impact assessments.
- Consent managerA registered service that lets people manage consent in one place.
- A platform registered with the Data Protection Board through which a data principal can give, manage, review and withdraw consent. Consent managers are accountable to the data principal, not to the fiduciary.
- Grievance officerThe named contact for privacy complaints.
- The person a data principal can contact about how their personal data is being handled. Their contact details have to be published and reachable — a form with no named role, or an address that bounces, does not satisfy this.
- RetentionHow long data is kept, and when it is erased.
- Personal data should be erased once the purpose it was collected for is no longer being served and there is no legal requirement to keep it. Retention is about having a defined, followed schedule — not about keeping data indefinitely “just in case”.
- Verifiable consentConsent you can later demonstrate you obtained.
- Free, specific, informed, unconditional and unambiguous agreement to a stated purpose, recorded in a way that can be produced later. A ticked box with no record of what was shown, when, or by whom is not verifiable.
CompliLens results
What each status and evidence state means in a report.
- Rule packThe fixed set of DPDP controls this assessment is checked against.
- An immutable, versioned list of controls drawn from the DPDP Act and Rules. Every result names the rule-pack version it came from, so a report can be reproduced exactly. Controls are never added or edited during an assessment.
- CompliantEvidence shows this control is met.
- One of five rule-book statuses. It means the available evidence supports the control — not that the organisation as a whole is certified or legally compliant.
- GapEvidence shows this control is not met.
- The evidence positively indicates the requirement is not satisfied. This is different from having no evidence at all, which is never treated as a gap.
- Readiness gapSomething exists, but not in a form you could demonstrate.
- A CompliLens status for when a practice is partly in place — happening informally, or documented but not followed, or followed but not recorded. It is a warning that you could not currently evidence the control, not an accusation that you are breaking the law.
- Not applicableThis control does not apply, and the reason can be documented.
- Used when a requirement genuinely does not apply to the assessment scope — for example children's-data rules where no children's data is processed. The reason is recorded so the exclusion can be justified later.
- Needs legal reviewA qualified person has to decide this one.
- The evidence is genuinely ambiguous, or the control turns on a legal judgement a tool should not make. CompliLens surfaces these rather than guessing in either direction.
- ObservedThe scan directly saw this.
- A technical observation from public pages or browser behaviour. Rendered with a solid, filled badge — a settled finding.
- Not observedThis bounded scan did not find it.
- Rendered with a dotted, unfilled badge. It means only that the scan did not see the thing within its limits. It is not proof that the thing is absent, and it never creates a gap on its own.
- Needs confirmationAn open question, not a finding.
- Rendered with a dashed border, because the edge should look unresolved. Something can only be confirmed by you or by a document — a website scan cannot establish it either way.
- Website / Local / HybridThe three ways an assessment can be scoped.
- A website assessment starts from public pages. A local assessment starts without a public website and relies on your answers and the privacy-safe local scanner. A local assessment becomes hybrid when you add an authorised website later — existing answers, scanner reports and documents are all preserved.
Something still unclear?
If a term in your report is not defined here, tell us and we will add it.
Contact support