Rule 2: Definitions

Rule 2 performs a conventional but important legislative function. It provides definitions necessary for understanding the Rules and, where the Rules do not create their own definition, imports the meanings already assigned by the DPDP Act.

The second sub-rule is particularly important. It provides that words and expressions used in the Rules but not defined there, which are defined in the Act, carry the meanings assigned to them in the Act.

This creates a hierarchy of definitions.

Where the Rules expressly define a term, the Rule's definition governs in the context of the Rules, subject to the ordinary principles of statutory interpretation.

Where the Rules do not define the term, the Act's definition is carried into the Rules.

This avoids the possibility of two parallel vocabularies developing between the Act and Rules.

Rule 2 expressly defines four expressions:

  • Act
  • techno-legal measures
  • user account
  • verifiable consent

The first definition is straightforward. "Act" means the Digital Personal Data Protection Act, 2023. Its importance lies principally in avoiding repetitive references to the full title of the parent legislation.

The definition of "techno-legal measures" is unusual because it does not itself explain the substantive content of the expression. Instead, it refers to Rules 20 and 22. The meaning therefore has to be understood by reading those provisions together with Rule 2.

The definition of "user account" is considerably more significant. It covers an online account registered by the Data Principal with the Data Fiduciary and expressly extends to profiles, pages, handles, email addresses, mobile numbers and other similar presences through which the Data Principal can access the Data Fiduciary's services.

The breadth of this definition matters because later provisions use the concept of a user account as a mechanism for communication and rights-related interaction. The definition prevents a Data Fiduciary from taking an artificially narrow view that only a conventional username-and-password account constitutes a "user account."

The fourth definition, "verifiable consent", is defined by reference to Rules 10 and 11. This is particularly relevant to child data and persons with disabilities who have lawful guardians. It demonstrates a drafting technique used repeatedly in the Rules: the substantive concept is introduced in one provision but operationalised through another.

Rule 2 must therefore be read as an interpretive bridge, rather than as a self-contained glossary.