Data Fiduciary: An organization or entity that determines the purpose and means of processing personal data.

Data Principal: The individual to whom the personal data relates (e.g., a patient or customer).

Data Processor: Any entity that processes personal data on behalf of a Data Fiduciary.

Data Protection Officer (DPO): The designated point of contact responsible for ensuring compliance with the DPDP Act.

Consent Manager: An entity registered with the Data Protection Board that acts as a single point of contact to enable Data Principals to give, manage, review, and withdraw their consent.

ISMS (Information Security Management System): The systematic framework required for ISO 27001 certification to manage sensitive data and mitigate risks.

SoA (Statement of Applicability): A key ISO 27001 audit document explaining which information security controls an organization has implemented .

Data Breach Notification: Mandatory reporting protocol for notifying regulatory bodies and affected Data Principals of unauthorized data access.

Data Localization: Requirements mandating that specific categories of data be stored strictly within national borders.

ABHA (Ayushman Bharat Health Account): A unique, randomized 14-digit health identification number used to link medical records securely.

HIP (Health Information Provider): Hospitals, diagnostic labs, or clinics that generate and store digital health records on the ABDM network.

HIU (Health Information User): Doctors or health facilities authorized to access digital patient records through the ABDM network.

Consent Artifact: The digitally signed, time-bound consent granted by a Data Principal to share specific medical records between a HIP and HIU.

ABDM HDM Policy: The Health Data Management Policy defining the rules for secure processing of personal and sensitive medical data within the NDHE (National Digital Health Ecosystem).

NABH Digital Health Standards: The framework used to assess a healthcare facility's IT infrastructure, cybersecurity posture, and patient data privacy workflows.

Digital Operations Management: The NABH chapter evaluating a hospital's IT resilience and its ability to safeguard sensitive patient data from digital threats.

RoP (Record of Processing): Documentation detailing data collection practices, retention schedules, and security measures.

DPIA (Data Protection Impact Assessment): Formal risk assessments conducted before processing operations to evaluate potential risks to Data Principals.

Audit Trail: Chronological logs tracking who accessed patient or user records, when they accessed them, and any modifications made.

Compliance Posture: An organization’s overall standing and readiness against defined statutory laws or security frameworks.