Glossary

The policies, roles, processes and controls through which an organisation governs its development or use of AI systems, built on the same clause structure as ISO/IEC 27001 and certifiable against ISO/IEC 42001, published in December 2023. It covers AI-specific risks (bias, transparency, safety, accountability) alongside security, and expects you to assess impacts on individuals and society as well as on the organisation. It is the only certifiable AI governance standard, and the main route companies use to show EU AI Act readiness.

The top-management statement that sets the organisation's direction for AI: which principles it commits to, what it will and will not build or use, how it handles risk, and who is accountable. Clause 5.2 requires the policy to fit the organisation's purpose, give a framework for AI objectives, commit to meeting requirements and to continual improvement, and be communicated; Annex A control A.2.2 repeats the requirement and A.2.3 adds alignment with other policies. Auditors expect it to be approved, dated and traceable to the controls you operate.

The process of identifying, analysing and evaluating the risks that AI systems pose to your organisation's objectives, so that you can decide which to treat. Clause 6.1.2 requires defined criteria, repeatable results and identified risk owners; clause 6.1.3 then requires a risk treatment plan drawing on the Annex A controls. Annex C lists AI-specific risk sources, such as data quality, lack of transparency and automation bias, to help you be systematic.

A documented assessment of the consequences an AI system may have for individuals, groups and society: fairness, safety, privacy, livelihoods, the environment. Clause 6.1.4 requires you to define a process for it and clause 8.4 to run it at planned intervals and when a significant change is proposed; Annex A objective A.5 adds the controls. It differs from an AI risk assessment, which looks at risk to the organisation, and overlaps with a Data Protection Impact Assessment under DPDP s. 10(2)(c) and GDPR Art. 35 where personal data is involved.

The normative list of 93 reference information security controls in ISO/IEC 27001:2022, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them; you compare your risk treatment against the list to check nothing is missing and record the result in the Statement of Applicability. ISO/IEC 27002:2022 gives implementation guidance for each control.

The normative list of 38 AI-specific reference controls in ISO/IEC 42001:2023, under nine objectives from A.2 to A.10: policies related to AI, internal organisation, resources for AI systems, assessing impacts, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. As with ISO 27001 you select controls from the list through risk treatment and justify exclusions in a Statement of Applicability. Annex B gives implementation guidance for each control.

The Telecom Disputes Settlement and Appellate Tribunal, which hears appeals against the Data Protection Board's orders and directions. You have 60 days to appeal (s. 29(2)), and the Tribunal is to work as a digital office as far as practicable. Rule 22 of the DPDP Rules 2025 sets the procedure and takes effect on 13 May 2027, with the rest of the Act's enforcement provisions.

The choice SEBI gave listed entities on 28 Mar 2025 for independent verification of BRSR Core: "assurance", an engagement by a professional under assurance standards, or "assessment", a third-party check under the standards the Industry Standards Forum developed with SEBI. Before this circular, reasonable assurance was mandatory. The same circular made value chain ESG disclosures voluntary for the top 250 entities from FY 2025-26 and their assessment or assurance voluntary from FY 2026-27; the glide path to the top 1,000 in FY 2026-27 is unchanged.

A short letter from the service organisation, not the auditor, covering the gap between the end of the last SOC 2 Type 2 period and the date a customer needs assurance for. It states whether the controls described in the report have changed materially and whether management knows of any failures since. It is not audited, so treat it as management's representation; most buyers accept one for a gap of up to about three months.

The Business Responsibility and Sustainability Report, the ESG disclosure that the top 1,000 listed entities by market capitalisation must file with their annual report, mandatory from FY 2022-23 after a voluntary year. It is structured on the nine principles of the National Guidelines on Responsible Business Conduct, with essential indicators every filer answers and leadership indicators that are voluntary. It replaced the older Business Responsibility Report.

A subset of the BRSR: key performance indicators under nine ESG attributes (greenhouse gas footprint, water footprint, energy footprint, circularity and waste, employee well-being and safety, gender diversity, inclusive development, fairness to customers and suppliers, and openness of business) that must be independently verified. The 12 Jul 2023 circular set a glide path by market capitalisation: the top 150 listed entities in FY 2023-24, 250 in FY 2024-25, 500 in FY 2025-26 and 1,000 in FY 2026-27. It originally required reasonable assurance; since 28 Mar 2025 you may choose assessment or assurance.

The binding directions CERT-In issued on 28 Apr 2022 to all service providers, intermediaries, data centres, body corporates and government organisations, effective 60 days after issue. They require you to report the cyber security incidents listed in Annexure I to CERT-In within 6 hours of noticing them, keep logs of all ICT systems for a rolling 180 days within India, synchronise system clocks to the NIC or NPL time servers, and designate a point of contact; data centre, VPS, cloud and VPN providers must also keep validated customer records for five years. Non-compliance is punishable under s. 70B(7) of the IT Act with imprisonment of up to one year, a fine, or both.

The grounds on which a Data Fiduciary may process personal data without consent: a purpose for which you volunteered the data and have not objected, state functions and benefits, legal obligations and court orders, medical emergencies and epidemics, disaster response, and employment-related purposes, among those listed in s. 7. Together with consent (s. 6) they are the only two lawful bases under the Act (s. 4). There is no general "legitimate interests" ground.

An individual who has not completed eighteen years of age. The threshold is higher than GDPR's 16, which member states may lower to 13, and the CCPA's 13 and 16. For a child you need verifiable parental consent, must not process data in a way likely to harm the child's well-being, and must not track, monitor behaviour or target advertising (s. 9), subject to the exemptions in Rule 12 and the Fourth Schedule of the DPDP Rules 2025 for purposes such as health care and education.

Controls that a service organisation assumes its customers (user entities) will operate for the Trust Services Criteria to be met, listed in the system description. Typical examples: managing your own user accounts in the vendor's product, reviewing access reports, and telling the vendor when staff leave. When you read a vendor's SOC 2, check this list, because the auditor's opinion assumes you are doing these things; the sibling term, complementary subservice organisation controls, covers the vendor's own suppliers.

Your agreement to processing for a specified purpose, which must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for that purpose. You can withdraw it as easily as you gave it (s. 6(4)); withdrawal does not undo processing already done, but the fiduciary must stop within a reasonable time and make its processors stop too (s. 6(6)). Any part of a consent that infringes the Act or another law is invalid to that extent (s. 6(2)).

A company registered with the Data Protection Board that gives you one place to give, manage, review and withdraw consent across many Data Fiduciaries, through an accessible, transparent and interoperable platform. It acts on your behalf and is accountable to you (s. 6(8)). Rule 4 and the First Schedule of the DPDP Rules 2025 set the registration conditions, which include being a company incorporated in India with a net worth of at least Rs 2 crore; Rule 4 takes effect one year after the Rules, around 13 Nov 2026.

Any real or suspected adverse event in relation to cyber security that violates an applicable security policy and results in unauthorised access, denial of service or disruption, unauthorised use of a computer resource, or changes to data or information without authorisation. Annexure I of the 2022 Directions lists twenty types you must report to CERT-In within 6 hours, including data breaches and leaks, ransomware and other malware, website defacement, denial of service attacks, attacks on cloud, IoT and AI systems, and incidents affecting digital payments. It is wider than a personal data breach: an incident that touches no personal data still has to be reported.

The company or person who decides why and how personal data is processed. Under DPDP the Data Fiduciary carries the duties: notice, consent, security safeguards, breach reporting, erasure and answering people's requests. If a Data Processor does the work, the fiduciary still answers for it (s. 8(1)).

The individual the personal data is about. For a child, the term includes the parents or lawful guardian; for a person with a disability, their lawful guardian acting on their behalf. The Act gives you, as Data Principal, rights to information, correction and erasure, grievance redressal and nomination (ss. 11 to 14), and duties of your own, such as not filing false complaints (s. 15).

Anyone who processes personal data on behalf of a Data Fiduciary. A cloud host, a payroll vendor or an analytics provider is usually a Data Processor. The Act places its duties on the fiduciary, which may engage a processor only under a valid contract (s. 8(2)) and remains responsible for compliance whatever the contract says (s. 8(1)).

The regulator the Act creates to receive breach intimations and complaints, inquire into them, direct remedial measures and impose the penalties in the Schedule, up to Rs 250 crore for a failure of security safeguards. It works as a digital office (s. 28) and its orders can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (s. 29). The Central Government established it by notification G.S.R. 844(E) on 13 Nov 2025; MeitY invited applications for its Chairperson and Members on 6 May 2026.

The individual a Significant Data Fiduciary must appoint to represent it under the Act. The DPO must be based in India, be responsible to the board of directors or a similar governing body, and be the point of contact for the grievance redressal mechanism. Other Data Fiduciaries need not appoint a DPO, but every fiduciary must publish the contact details of a person who can answer questions about its processing (s. 8(9)).

Personal data in digital form. The Act applies to personal data collected digitally, and to personal data collected on paper and digitised later (s. 3(a)). Paper records that are never digitised fall outside it, as does data you process for a personal or domestic purpose and data a Data Principal has made publicly available themselves (s. 3(c)).

An instance where a control did not operate as described during the auditor's testing: a new joiner without an approved access request, a quarterly review done late. The auditor lists exceptions in Section 4 with management's response, and decides whether they are serious enough to qualify the opinion. A report with a few exceptions and a clean opinion is normal; read the exceptions, not just the opinion.

Your right to a readily available way to complain to a Data Fiduciary or Consent Manager about how it has handled your personal data or your rights. The fiduciary must set up an effective mechanism (s. 8(10)), publish how to reach it and respond within a stated time; the DPDP Rules 2025 cap that period at 90 days. You must exhaust this route before you complain to the Board (s. 13(3)), and a Significant Data Fiduciary's Data Protection Officer is the point of contact for it (s. 10(2)(a)).

Under the EU AI Act, an AI system that is either a safety component of a product covered by the EU product laws listed in Annex I, or is used in one of the areas listed in Annex III: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and the administration of justice. Providers must run a risk management system, data governance, documentation, logging, human oversight and a conformity assessment before placing it on the EU market; Indian companies that sell such systems into the EU are caught. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, adopted 8 Jul 2026), the Annex III obligations apply from 2 Dec 2027 and the Annex I obligations from 2 Aug 2028.

The set of policies, processes, roles and controls through which an organisation manages information security risk as a continuing activity, not a one-off project. ISO/IEC 27001 is the standard an ISMS is certified against: clauses 4 to 10 set the management requirements and Annex A lists the reference controls. A certificate means an accredited body has audited the system; it does not mean the company cannot be breached.

Your right to name another individual who will exercise your rights under the Act if you die or become incapacitated. "Incapacity" means being unable to exercise your rights because of unsoundness of mind or infirmity of body (s. 14(2)). GDPR has no equivalent: it does not apply to the data of deceased persons at all (Recital 27).

A failure to meet a requirement of the standard, of your own management system, or of a legal obligation you have brought into scope. Clause 10.2 requires you to react, correct, find the root cause and check that the corrective action worked. Certification bodies grade findings as major (a breakdown that blocks certification until closed) or minor (an isolated lapse, closed through an agreed plan); an "opportunity for improvement" is not a nonconformity.

The information a Data Fiduciary must give you with, or before, every request for consent: the personal data it wants and the purpose, how you can exercise your rights and withdraw consent, and how to complain to the Board. Rule 3 of the DPDP Rules 2025 requires the notice to stand on its own, in clear and plain language, with an itemised description of the data and of the goods, services or uses it enables, and a link to the fiduciary's website or app. If you consented before the Act commenced, the fiduciary must still send you this notice as soon as reasonably practicable (s. 5(2)), in English or any language in the Eighth Schedule to the Constitution (s. 5(3)).

Any data about an individual who can be identified by it or in relation to it. The test is identifiability, not sensitivity: a name, an email address, a device identifier or a combination of facts all count. The Act has no separate category of sensitive personal data; the same rules apply to all personal data in digital form.

Any unauthorised processing of personal data, or an accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability; a ransomware attack that only locks data counts. You must intimate the Board and each affected Data Principal (s. 8(6)); Rule 7 of the DPDP Rules 2025 requires both without delay and a fuller report to the Board within 72 hours, or a longer period the Board allows. The penalty for failing to notify is up to Rs 200 crore.

The two roles the ISO privacy standards attach controls to. A PII controller decides why and how personally identifiable information is processed; a PII processor processes it on the controller's behalf and on its instructions. They map to Data Fiduciary and Data Processor under DPDP and to controller and processor under GDPR, but the standards only tell you which controls to implement; the legal duties come from the law that applies to you.

A management system for the processing of personally identifiable information, built on the same clause structure as an ISMS and certified against ISO/IEC 27701. The second edition, published in October 2025, made ISO/IEC 27701 a stand-alone standard, so you no longer need an ISO/IEC 27001 certificate to hold one; the 2019 edition was an extension to ISO/IEC 27001 and is withdrawn. Annex A sets controls for PII controllers and PII processors, Annex B gives implementation guidance, and Annex D maps the controls to the GDPR, which makes a PIMS a practical scaffold for DPDP duties too.

Any wholly or partly automated operation on digital personal data, from collection and storage through use, sharing and disclosure to erasure and destruction. Almost everything a business does with data is processing. A purely manual operation on paper is not, which is why the Act keys off digital form.

The Reserve Bank of India (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023, in force from 1 Apr 2024 for commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions. They require a board-level IT Strategy Committee chaired by an independent director with IT expertise, a CISO who does not report to the head of IT, a risk-based information systems audit function, vulnerability assessments every six months and penetration tests every twelve months for critical systems, and half-yearly disaster recovery drills. Cyber incidents must be reported to RBI and to CERT-In as required; the separate Master Direction on Outsourcing of IT Services (10 Apr 2023) covers your vendors.

Your right to have a Data Fiduciary erase personal data you consented to its processing, unless retention is necessary for the specified purpose or required by law (s. 12(3)). Separately, the fiduciary must erase data of its own accord once you withdraw consent or the purpose is no longer served (s. 8(7)); Rule 8 and the Third Schedule of the DPDP Rules 2025 deem the purpose served after three years without contact for large e-commerce, online gaming and social media platforms, with at least 48 hours' notice to you before erasure. Requests go through the fiduciary's published grievance channel and must be answered within the period it publishes, which the Rules cap at 90 days.

The plan that says what you will do about each information security risk you have assessed, with owners and dates: modify it with controls, retain it, avoid it or share it. Clause 6.1.3 requires you to write the plan, have risk owners approve it and accept the residual risk; clause 8.3 requires you to carry it out and keep evidence. It is the bridge between the risk assessment and the Statement of Applicability.

SEBI's Cybersecurity and Cyber Resilience Framework for all its regulated entities: stock exchanges and other market infrastructure institutions, brokers, depository participants, mutual funds, portfolio managers, registrars and the rest. It replaced the earlier sector-by-sector circulars with one graded framework (MIIs, Qualified, Mid-size, Small-size and Self-certification REs) built on the functions govern, identify, protect, detect, respond and recover, with periodic cyber audits by CERT-In empanelled auditors and a Cyber Capability Index for the largest entities. After extensions the compliance date for most REs was 31 Aug 2025; the technical clarifications of 28 Aug 2025 made some items recommendatory, including ISO 27001 certification, and let an RE rely on an equivalent framework of another regulator such as RBI.

A Data Fiduciary, or a class of them, that the Central Government notifies under s. 10 after weighing the volume and sensitivity of the data it handles, the risk to Data Principals, and wider interests such as electoral democracy and the security of the State. A Significant Data Fiduciary must appoint a Data Protection Officer based in India, engage an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Rule 13 of the DPDP Rules 2025 makes the assessment and audit annual and adds due diligence on algorithmic software; the penalty for breaching s. 10 is up to Rs 150 crore.

An attestation report, issued by a licensed CPA firm under AICPA standards, on a service organisation's controls relevant to security and, optionally, availability, processing integrity, confidentiality and privacy. It is not a certificate: the auditor gives an opinion on your system description and controls against the Trust Services Criteria, and you share the report with customers under NDA. Indian SaaS and IT services companies selling to US buyers meet it as a procurement requirement.

The first part of an initial certification audit, in which the certification body reviews your documented management system, scope, risk assessment, Statement of Applicability and internal audit results, and judges whether you are ready for Stage 2. It can be done remotely. The output is a list of areas of concern that could become nonconformities if you do not fix them before Stage 2.

The second part of the initial certification audit, in which auditors test that your management system is implemented and effective: they interview staff, sample records and check controls against the Statement of Applicability. Nonconformities found here must be closed, or have an accepted corrective action plan, before the certificate is issued. The certificate then runs for three years, with surveillance audits in between.

The document that lists every Annex A control, says whether you have included or excluded it, justifies the choice, and records whether each included control is implemented. Auditors read it first, because it ties your risk treatment to the 93 reference controls and shows what the certificate covers. You can add controls from other sources, such as CERT-In or SEBI requirements, and list them alongside.

The shorter audit a certification body carries out at least once a calendar year during the three-year certificate cycle to confirm the management system still works: internal audits, management review, handling of complaints and incidents, action on earlier nonconformities and a sample of controls. The first one must take place within twelve months of the certification decision. A recertification audit at the end of year three starts the cycle again.

Section 3 of a SOC 2 report, written by the service organisation's management, describing the system in scope: services, infrastructure, software, people, data and processes, the control environment, the controls that meet each criterion, subservice organisations, and the controls you expect customers to operate. The auditor gives an opinion on whether it is fairly presented against the AICPA's description criteria. It is where a reader learns what the report does and does not cover.

The control criteria a SOC 2 report is written against, published by the AICPA's Assurance Services Executive Committee. There are five categories: security (the common criteria, CC1 to CC9, which every report includes), availability, processing integrity, confidentiality and privacy. Each criterion has points of focus that guide, but do not dictate, the controls you need; the 2022 revision updated the points of focus without changing the criteria.

A Type 1 report gives the auditor's opinion on whether your controls were suitably designed at a point in time. A Type 2 report adds an opinion on whether they operated effectively over a period, typically three to twelve months, and includes the tests performed and their results. Buyers ask for Type 2; a Type 1 is a first step when you have not yet run the controls long enough to test them.

The consent a Data Fiduciary must obtain from a parent or lawful guardian before processing a child's personal data, or that of a person with a disability who has a lawful guardian. "Verifiable" means you must check that the person consenting is an adult and is who they claim to be; Rule 10 of the DPDP Rules 2025 lets you rely on identity and age details you already hold, or on details or a virtual token issued by a body entrusted by law or by a Digital Locker service provider. Breaching s. 9 carries a penalty of up to Rs 200 crore.