Privacy & Consent Glossary: DPDPA, GDPR & Compliance Terms Explained
Simple definitions of DPDPA, GDPR, CCPA and important consent-management terms.
Privacy Regulations and Compliance Updates
Privacy regulations continue to evolve, and businesses need to stay informed about the latest legal requirements. India's Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025, introducing important regulatory developments for organizations handling personal data in India.
Non-compliance with privacy regulations can result in significant financial penalties and regulatory action. Under the GDPR, certain infringements can lead to fines of up to €20 million or 4% of an undertaking's total worldwide annual turnover of the preceding financial year, whichever is higher, depending on the violation.
This glossary is regularly updated to reflect important regulatory changes and help businesses understand evolving privacy compliance requirements.
Why These Terms Matter for Your Business
Privacy and consent terms affect more than legal compliance. They influence how businesses collect and process personal data, manage advertising operations - where signals such as Google Consent Mode v2 and Global Privacy Control (GPC) decide what is allowed to run - and comply with privacy regulations. Understanding these concepts helps teams make informed decisions about data collection, consent management, and privacy compliance.
A single mistake in privacy and consent operations, such as placing marketing cookies without the required Cookie Consent, letting a tag fire that Prior Script Blocking should have held back, or missing a DSAR deadline, can lead to serious consequences. These may include significant fines, intervention from data protection authorities, and damage to a business's reputation.
This glossary is useful for DPOs, compliance managers, marketers, developers, and founders who need to understand privacy requirements and apply them in their daily operations. ConsentX helps businesses implement and manage privacy and consent operations through its Consent Management Platform (CMP), down to the Consent Receipt that records what each visitor agreed to.
Why ConsentX Built This Glossary
Privacy laws can be complicated because they include legal terms, acronyms, and complex requirements. ConsentX created this glossary to help people understand important privacy and consent terms in simple language and help businesses become more privacy-compliant.
The same simplified approach is used in ConsentX's consent management platform, helping businesses manage privacy and consent operations more easily and understand their compliance requirements.
Consent
Consent Management Platform · CMP
A consent management platform (CMP) is software that collects, stores and enforces a user's choices about cookies and personal-data processing, and proves those choices to regulators.
Cookie Consent
Cookie consent is the user's permission to set non-essential cookies and trackers, which most privacy laws require you to obtain before those cookies load.
Prior Consent (Prior Blocking)
Prior consent means non-essential trackers must stay inert until the user agrees, and prior blocking is the technical enforcement that keeps them from firing on the first page view.
India / DPDPA
Digital Personal Data Protection Act · DPDPA
The DPDPA (DPDP Act 2023) is India's national data-protection law, requiring clear notice and free, specific, informed consent before processing personal data, with the DPDP Rules notified on 13 November 2025.
Data Fiduciary
Under India's DPDPA, a Data Fiduciary is the entity that decides why and how personal data is processed, equivalent to a 'controller' under the GDPR.
Data Principal
Under India's DPDPA, a Data Principal is the individual whose personal data is being processed, equivalent to a 'data subject' under the GDPR.
Data Processor
Under India's DPDPA, a Data Processor is any person who processes personal data on behalf of a Data Fiduciary, broadly equivalent to a 'processor' under the GDPR.
Data Principal Rights
Data Principal rights are the rights India's DPDPA gives individuals over their personal data: access to information, correction and erasure, grievance redressal, nomination and withdrawal of consent.
Consent Manager (DPDPA)
Under India's DPDPA, a Consent Manager is a registered, interoperable platform through which a Data Principal can give, manage, review and withdraw consent across Data Fiduciaries.
Data Protection Board of India · DPB
The Data Protection Board of India is the body that enforces the DPDPA, investigates breaches and consent complaints, and imposes penalties of up to ₹250 crore per instance.
Global laws
General Data Protection Regulation · GDPR
The GDPR is the European Union's data-protection law, requiring a lawful basis (often consent) to process personal data, with fines up to €20 million or 4% of global turnover.
California Consumer Privacy Act · CCPA / CPRA
The CCPA, expanded by the CPRA, is California's privacy law giving consumers the right to opt out of the sale or sharing of their personal data and to access and delete it.
Cross-Context Behavioral Advertising
Cross-context behavioral advertising (CCBA) is targeting ads to a consumer based on their personal data gathered across businesses, websites or apps they do not control - a practice California's CCPA/CPRA lets consumers opt out of.
Signals & standards
Google Consent Mode v2
Google Consent Mode v2 is Google's framework for passing a user's consent choices to Google tags, which adjust their behaviour and (when consent is denied) use privacy-safe modelling instead.
Global Privacy Control · GPC
Global Privacy Control (GPC) is a browser signal that tells websites a user wants to opt out of the sale or sharing of their personal data, and several US state laws treat it as a legally binding opt-out.
IAB Transparency & Consent Framework · TCF
The IAB TCF is an ad-industry standard that captures and transmits user consent for advertising purposes and vendors in a structured 'TC string' across the programmatic supply chain.
Rights & evidence
Data Subject Access Request · DSAR
A DSAR is a request by an individual to access, correct, delete or port the personal data an organisation holds about them, which must be answered within a statutory deadline.
Consent Receipt
A consent receipt is a tamper-evident, time-stamped record of exactly what a user agreed to, including the purposes, the policy version and a verifiable hash, used as proof of valid consent.
Legitimate Interest
Legitimate interest is a lawful basis under the GDPR for processing personal data without consent when the organisation's interest is not overridden by the individual's rights, established through a balancing test.