Section 2 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
After the main roles and the data definitions, section 2 has a group of supporting terms that other sections rely on. This article covers them clause by clause: Appellate Tribunal, Board, certain legitimate uses, Chairperson, digital office, gain, loss, Member, notification, prescribed, proceeding, "she", specified purpose and State. Where a term affects your own notices or contracts, a legal consultation can settle how to apply it.
These terms decide who hears appeals (the Telecom Disputes Settlement and Appellate Tribunal), who regulates (the Data Protection Board of India), what "prescribed" means (by rules made under the Act), and what purpose a notice must state (the "specified purpose" in section 2(za)). "Gain" and "loss" are defined in section 2(o) and 2(p) and are used in the section 33 penalty factors. "State" means the State under article 12 of the Constitution.
The remaining terms at a glance
| Clause | Term | Meaning in brief |
|---|---|---|
| 2(a) | Appellate Tribunal | The Telecom Disputes Settlement and Appellate Tribunal established under section 14 of the Telecom Regulatory Authority of India Act, 1997 |
| 2(c) | Board | The Data Protection Board of India established by the Central Government under section 18 |
| 2(d) | certain legitimate uses | The uses referred to in section 7 |
| 2(e) | Chairperson | The Chairperson of the Board |
| 2(m) | digital office | An office that adopts an online mechanism so that proceedings, from receipt to disposal, are conducted in online or digital mode |
| 2(o) | gain | A gain in property or supply of services (temporary or permanent), or an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by legitimate remuneration |
| 2(p) | loss | A loss in property or interruption in supply of services (temporary or permanent), or a loss of opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by legitimate remuneration |
| 2(q) | Member | A Member of the Board; includes the Chairperson |
| 2(r) | notification | A notification published in the Official Gazette |
| 2(v) | prescribed | Prescribed by rules made under the Act |
| 2(w) | proceeding | Any action taken by the Board under the Act |
| 2(y) | she | Includes any individual irrespective of gender |
| 2(za) | specified purpose | The purpose mentioned in the notice given by the Data Fiduciary to the Data Principal under the Act and the rules |
| 2(zb) | State | The State as defined in article 12 of the Constitution |
Board, Chairperson, Member and Appellate Tribunal
Section 2(c) points to section 18 for the Board, so the Board exists only as and when the Central Government establishes it. Section 2(q) includes the Chairperson within "Member", which matters for sections 19 to 22, where the same rules apply to both. The Appellate Tribunal in section 2(a) is the Telecom Disputes Settlement and Appellate Tribunal under section 14 of the TRAI Act, 1997; section 29 gives it the appeal jurisdiction. The Act does not create a new tribunal.
Digital office and proceeding
Section 2(m) defines a "digital office" as one that adopts an online mechanism for the entire journey of a matter, from receipt of an intimation, complaint, reference, directions or appeal to final disposal. Sections 28(1) and 29(10) then require the Board and the Appellate Tribunal to function, as far as practicable, as a digital office. Section 2(w) defines "proceeding" as any action taken by the Board under the Act, which is the word used in section 28 (procedure of the Board) and section 32 (voluntary undertaking).
Gain and loss
These two are easy to overlook but they have a job. Section 33(2)(d) lists, among the matters the Board must consider when fixing a penalty, "whether the person, as a result of the breach, has realised a gain or avoided any loss". Both terms are defined in broad economic language.
- Gain (section 2(o)) covers a gain in property or supply of services, or an opportunity to earn remuneration or a financial advantage other than legitimate remuneration.
- Loss (section 2(p)) covers a loss in property or an interruption in supply of services, or the loss of an opportunity to earn remuneration or a financial advantage other than legitimate remuneration.
Note that both include temporary or permanent effects for property and services. A short outage can therefore be a loss for this purpose. The Act does not give a formula; the Board weighs these along with the other factors in section 33(2).
Specified purpose
Section 2(za) makes the purpose stated in the notice the reference point. The "specified purpose" is the purpose mentioned in the notice the Data Fiduciary gave under the Act and the rules. It appears in:
- section 6(1): consent must be for the specified purpose and limited to the personal data necessary for it;
- section 7(a): legitimate use for the specified purpose for which the Data Principal voluntarily provided her data;
- section 8(7)(a): erasure once it is reasonable to assume the specified purpose is no longer being served; and
- section 12(3): erasure on request unless retention is necessary for the specified purpose or legal compliance.
The practical lesson is that vague notices cause trouble later. If the notice is broad, the "specified purpose" becomes broad and so does the question of what is necessary; if it is precise, each later duty can be measured against it. See the article on notice under section 5.
Certain legitimate uses, prescribed, notification and "she"
- Certain legitimate uses (section 2(d)) simply points to section 7.
- Prescribed (section 2(v)) means prescribed by rules made under the Act. Wherever the Act says "as may be prescribed", the detail is in the rules made under section 40. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates; check the Rules for each.
- Notification (section 2(r)) is a notification in the Official Gazette; "notify" and "notified" follow.
- "She" (section 2(y)) includes any individual irrespective of gender. This is why the Act uses "she" throughout, and why the Illustrations use "X" and "Y".
State
Section 2(zb) borrows article 12 of the Constitution. That article is not reproduced in the Act, so the meaning of "State" here is the constitutional one. The Act also separately lists "the State" within "person" in section 2(s)(vi). This matters for sections 7(b) to (d) and section 17(2) and (4), which give the State and its instrumentalities special treatment.
Practical examples
Example 1: a loyalty app. An app's notice says data is collected "to run the loyalty programme". That is the specified purpose. Using the same data to sell it to advertisers would not be within it, and the question of what is necessary under section 6(1) is measured against it.
Example 2: a penalty inquiry. After a breach, the Board considers whether the Data Fiduciary saved costs by skipping safeguards. That maps to "gain" or "avoided loss" under section 33(2)(d), read with section 2(o) and 2(p).
Example 3: an appeal. A company disputes a Board order. The appeal goes to the Appellate Tribunal in section 2(a), which is the TDSAT.
Common mistakes
- Treating "prescribed" as a reference to the Act itself. It means the rules.
- Drafting a notice with an open-ended purpose and then relying on it as narrow.
- Assuming a new appeal body exists. The Act uses the existing Appellate Tribunal.
Need help with DPDP notices and purposes?
If your privacy notices use broad purposes or you are unsure how the specified purpose in section 2(za) should be worded, we can go through them with you. Begin with our legal consultation service and bring a copy of your current notice and consent screens.
Key takeaways
- The Appellate Tribunal in section 2(a) is the Telecom Disputes Settlement and Appellate Tribunal.
- "Prescribed" means prescribed by rules made under the Act.
- "Specified purpose" is the purpose stated in the notice and anchors consent, erasure and retention.
- "Gain" and "loss" are used in section 33(2)(d) when setting a penalty.
- "State" takes its meaning from article 12 of the Constitution.
Read next
- Section 2 of the DPDP Act, 2023: definitions of data and processing
- Section 2 of the DPDP Act, 2023: Data Principal, Data Fiduciary and Data Processor
- Section 5 of the DPDP Act, 2023: notice to Data Principal
- Data Protection Board of India under section 18
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.