Glossary

The words used in the console and in India's DPDP Act, each in one or two sentences. Key ideas explains the main product terms with examples.

A#

Acknowledgement#

In a notice campaign, a person's choice of I have read this notice. It is stored on the campaign and gives or changes no consent.

Always on#

A purpose that visitors cannot decline, meant for strictly necessary processing. Under the DPDP Act a purpose based on consent cannot be always on.

Anchor#

A signed summary of one day's consent events, sent to your webhooks. Your own copy lets you show later that nothing from that day was changed.

Answered records#

On an Overview chart, the records whose latest answer falls in the period, counted by what they are today: Granted, Partial, Denied, Withdrawn or Expired. Records waiting for an email confirmation are left out.

Audit log#

The list of every change made in the console and of each read of personal data there: what was done, by whom and when. Append-only: the database refuses changes and deletions.

B#

The first layer of a consent form on a website, where the visitor accepts, rejects or opens their choices. An app shows its own screen instead.

On an Overview chart, each time the banner was shown. A visitor who sees it on five pages counts five, so banner views count times, not people.

Batch root#

The Merkle root over the links of one batch of a notice campaign. It shows later which people were issued which link.

Breach register#

Where you record a personal data breach. It counts down the 72 hours for the detailed report to the Board.

C#

Campaign anchor#

A signed root over one day's notice campaign answers and issued batches, sent to your webhooks as campaign.anchored.

Capture context#

How consent was taken in a branch, by phone or on paper: the channel, how the person confirmed and your reference to the evidence. Sealed with the write that sent it. See Record consent taken in a branch, by phone or on paper.

Category#

The kind of purpose: strictly necessary, functional, analytics, marketing, personalisation, sale or sharing, or sensitive.

Child#

Under the DPDP Act, a person under 18.

Complaint link#

The link in a notice that tells people how to complain to the Data Protection Board of India. A form shown under a DPDP rule needs one.

A call your server makes to ask whether a person allows a purpose now. See Check consent before you process.

One thing you ask people to agree to, with its wording, purposes and settings. You edit it as a draft and publish it as a version.

Your statement, sealed as PRE_COMMENCEMENT, that a person consented before the DPDP Act commenced. The product records it and does not check it.

How long a decision stays valid before the person is asked again.

In the DPDP Act, a company registered with the Board that lets people give, manage, review and withdraw consent across many businesses (section 2(g)). Registration opens on 13 November 2026. PIEDAP Consent serves the Data Fiduciary and does not act as a Consent Manager. It can accept the consent and withdrawals people send you through one: see Accept consent from a Consent Manager.

How a region rule asks: opt in, opt out or notice only. Under opt in, nothing optional runs until the person agrees; under opt out, it runs until they decline.

A hosted page, headed Your consents, that lists every consent a person gave you. They can withdraw any of them and download their records.

What one person answered on one form, with the history of every change.

The list of cookies found on a property, which the product can show on your cookie policy page.

D#

Dashboard#

One person's arrangement of charts on the Overview. Each person keeps up to ten in a project, and nobody else sees them. See Customise your dashboard.

Data Fiduciary#

In the DPDP Act, whoever decides why and how personal data is processed. When you use PIEDAP Consent, this is your business.

Data Principal#

In the DPDP Act, the person the personal data is about. The console calls this person the subject.

Data Processor#

In the DPDP Act, whoever processes personal data on behalf of a Data Fiduciary.

Data Protection Board of India#

The body set up by the DPDP Act that looks into complaints and breaches and imposes penalties.

Data Protection Officer#

The person a Significant Data Fiduciary must appoint, based in India. Other businesses publish the contact of a person who answers questions about the processing.

Data used#

The list of personal data a purpose uses, shown under the purpose in the notice.

Double opt-in#

Email consent that counts only after the person follows a confirmation link sent to their address.

DPDP Act#

The Digital Personal Data Protection Act, 2023: India's law on the use of digital personal data.

DPDP Act check#

A report, opened from the Trackers page, that combines a scan of your site with your set-up and lists what passes and what needs fixing. It covers only what the product can see.

DPDP Rules#

The Digital Personal Data Protection Rules, 2025, which fill in the detail of the Act. They start in stages, listed in DPDP dates.

Draft#

A consent form's unpublished changes. Visitors do not see a draft.

E#

Eighth Schedule languages#

The 22 languages listed in the Eighth Schedule to the Constitution of India. A DPDP notice must be available in English or any of them, as the person chooses.

Erasure#

Removing the identifying details from a person's consent records, after withdrawing any consent still in force. The decisions and the sealed history stay as proof.

Everywhere else#

The region rule that applies when no other rule matches a visitor's place.

Evidence#

The sealed history of a consent record, which lets you show what a person was asked and what they answered. How consent is proven describes it.

F#

Fourth Schedule#

The part of the DPDP Rules that lists the kinds of business and the purposes exempt from some of the duties about children.

Full-grant rate#

The share of answered records that allow every purpose they were offered, counted by what each record is today. A grant that was later withdrawn or has expired no longer counts.

Full-grant rate, as answered#

The share of answers that allowed everything, as each answer was given. It can be drawn over time, but it will not match the full-grant rate, which follows each record to today.

G#

Global Privacy Control#

A browser signal that asks sites not to sell or share the visitor's data. Under an opt-out region rule, a form that honours it records the refusal without showing a banner.

Grievance#

A complaint a person makes to you about how their data is handled. Under the DPDP Rules you answer within the period you publish, at most 90 days.

H#

Hosted pages#

Pages the product serves for you: a privacy notice, the rights request page, the consent portal and email unsubscribe.

I#

Identifier#

What a consent record is kept under: a random browser id, an email address, a phone number, a user id, a device id or a session id. It is stored as a keyed hash.

Identity proof#

A code your server computes so that a browser can record consent under a signed-in person's real identifier, such as their email address.

Inactivity erasure#

Erasing a person's identifiers after a set period in which they did not use your service. You are warned by webhook 72 hours before.

K#

Key#

What connects a site, app or server to your project. A key is test or live, and holds a publishable key and, if you add one, a secret key.

L#

Legal basis#

The reason in law for a purpose. In India the DPDP Act allows consent or a legitimate use.

Legitimate use#

One of the uses listed in section 7 of the DPDP Act for which consent is not needed, such as a medical emergency or employment.

Linked identifier#

A further identifier attached to a consent record, so that the record can be found, withdrawn and erased by it.

Live key#

A key approved to write live records, which are your evidence.

M#

Material change#

A change in a new form version that asks returning visitors again. It is a new purpose or partner, a changed category or legal basis, or a longer-lasting decision on a purpose.

N#

Nomination#

A person's choice of someone to use their rights if they die or lose capacity. It is stored against the person from a Nomination request. See Record or cancel a nomination.

Notice#

What you tell a person before or when you ask for consent: the data, the purposes, and how to withdraw, use their rights and complain.

Notice campaign#

One published notice version sent to a list of people as single-use links that your own systems deliver. It records who was sent which version and who answered. See Send a notice to existing customers.

O#

Origin#

The address a website is served from, such as https://shop.example.in. A live publishable key works only on the origins you list for it.

P#

Partner#

A company that receives data for a purpose. Partners are listed under their purpose in the notice.

Partner register#

What each partner on your purposes is to you: a Data Processor, which gets stop and erase tasks, or an independent recipient. See Register your processors.

Person search#

Typing an email address, phone number or user id in Find a person or a record on the Records page. It lists the records kept under that identifier, or linked to it, in every property of the project, live and test. See Find a person.

Preference centre#

The dialog behind the banner where a visitor switches purposes, and partners, on or off one by one.

Privacy button#

The small button that stays on the page so a visitor can reopen their choices.

Privacy contact#

The email address people write to about their data, set in Project settings and shown in the notice.

Processor task#

An instruction to one registered Data Processor to stop or erase, written when a person withdraws, a consent expires or a person is erased. It holds no identifier.

Project#

Your workspace, which comes from the PIEDAP platform. Everything in PIEDAP Consent sits inside one project, and nothing is shared between projects.

Proof hash#

The seal on the latest state of a consent record. Each seal includes the one before, so the history cannot be changed unnoticed.

Property#

One website or app, with its own forms, region rules, keys and records.

Publishable key#

The key that goes in your page or app, starting pk_. Once live, it works only from the origins and app ids you list.

Purpose#

One reason you use personal data, which a visitor can allow or decline. Purposes are kept once for the project and reused by every form that offers them.

R#

Receipt#

A signed copy of one consent record, with the banner wording and the seal of every change. Someone outside your company can verify it.

Asking a returning visitor again, because the form changed in a material way or their consent expired.

Region rule#

Which form the visitors from a place see, under which law and with which consent model.

Reported by sender#

A delivery status your mailer or SMS gateway reported for a notice link. It is stored as reported and is not part of any proof.

Rights request#

Something a person asks you to do about their data, such as access or erasure, tracked with a reference and a deadline.

Runtime#

The script that shows the banner and holds back tags on a website. The current version is 1.0.7.

S#

Scope#

A permission granted to a secret key, such as subjects:erase.

Secret key#

The key your servers use, starting sk_. It is shown once and refused from browsers.

Significant Data Fiduciary#

A Data Fiduciary the Government notifies as significant under section 10 of the DPDP Act. It has extra duties, such as a Data Protection Officer based in India.

Subject#

The person a consent record or a rights request is about. The DPDP Act calls this person the Data Principal.

Subject fingerprint#

A second hash of a record's identifier, made with a key that belongs to your project. It lets you tell which of your people a receipt or a webhook concerns.

T#

Test key#

What every new key starts as. It writes test records that are kept apart from live ones and deleted 30 days after their last change.

Third Schedule#

The part of the DPDP Rules that lists the large platforms that must erase a person's data after three years of inactivity.

V#

The consent of a parent or lawful guardian, which the DPDP Act asks for before a child's data is processed.

Version#

A published, frozen copy of a consent form. Each consent record points at the version the person read.

W#

Webhook#

A signed message the product sends to your server when something happens. You choose the events each address receives.

Withdrawal#

A person taking back their consent. Every optional purpose is set to declined, and the change is recorded.

A#