The words,in plain English.

A

API

Application programming interface. A defined way for one system to send data to or request data from another, without anyone re-keying it.

B

Books of accountLaw

The accounting records a company must keep under section 128 of the Companies Act, 2013. They may be kept in electronic form, must stay accessible in India, and are kept for at least eight financial years. Insight: migrating accounting data →

C

Chain of custody

A record of who held a batch of documents or data, when, and how many items it contained at each hand-over.

CIN

Corporate Identity Number. The 21-character number the Registrar of Companies gives a company. It encodes listing status, activity code, state, year of incorporation, company class and a registration number.

Code on Wages, 2019Law

One of India's four labour codes, in force since 21 November 2025. It sets the definition of wages, payment deadlines (section 17), deduction limits (section 18) and records and wage slips (section 50).

Consent managerLaw

Under the DPDP Act, 2023, a person registered with the Data Protection Board through whom a data principal can give, manage, review and withdraw consent. The rule for their registration applies one year after the DPDP Rules were published.

Control total

A total (record count, amount or quantity) taken at source and checked again after each step, so nothing is lost or added on the way.

Cut-over

The moment work moves from the old system or process to the new one, following a dated plan with a rollback point.

D

Data fiduciaryLaw

Under the DPDP Act, 2023, the person who decides the purpose and means of processing personal data. In outsourced work, the client is normally the data fiduciary. How data is handled →

Data mapping

The written link between each field or code in the old system and its place in the new one, signed off before any data is loaded.

Data minimisation

Using only the personal data fields a task actually needs, and masking or tokenising identifiers where the task allows.

Data principalLaw

Under the DPDP Act, 2023, the individual to whom personal data relates. For a child or a person with a disability, it includes the parent or lawful guardian.

Data processorLaw

Under the DPDP Act, 2023, a person who processes personal data on behalf of a data fiduciary. A fiduciary may engage a processor only under a valid contract (section 8(2)). Insight: DPDP for processors →

Data Protection Board of IndiaLaw

The body set up under the DPDP Act, 2023 to handle personal data breaches and complaints and to impose penalties.

DPDP Act, 2023Law

The Digital Personal Data Protection Act, 2023. It sets duties for anyone processing digital personal data in India, and for processing outside India connected with offering goods or services to people in India.

DPDP Rules, 2025Law

The rules under the DPDP Act, published in November 2025. Most operational rules, including security safeguards, breach intimation and retention, commence eighteen months after publication, in May 2027.

E

Edit logLaw

A record of every change made in the books of account, with the date of the change. Since 1 April 2023, accounting software used by companies must keep one that cannot be disabled (Companies (Accounts) Rules, 2014, rule 3; the rules call it an audit trail).

Encryption at rest

Stored data kept in an encrypted form, so a copied disk or file cannot be read without the key.

Encryption in transit

Data encrypted while it moves between systems, for example over TLS, so it cannot be read on the way.

ETL

Extract, transform, load. Taking data out of a source, reshaping it, and loading it into a target system.

Exception queue

A list of items that failed a check. Each has a reason and an owner, and stays open until someone resolves it and records how.

G

GST record retentionLaw

Under section 36 of the CGST Act, 2017, GST accounts and records are kept until seventy-two months from the due date of the annual return for the year they relate to, and longer where proceedings are pending.

I

Income-tax Act, 2025Law

The Act that replaced the Income-tax Act, 1961 from 1 April 2026. Deduction of tax from salary is now under section 392 (formerly section 192). Insight: payroll inputs →

L

Least privilege

Each person or system gets only the access it needs for its task, and loses it when the task ends.

M

Maker-checker

A control where one person prepares an output (the maker) and a different person checks it (the checker) before it is released.

Master data

The reference records other transactions depend on: accounts, parties, employees, items, pay heads and departments.

MFA

Multi-factor authentication. Signing in with more than one proof of identity, such as a password and a code from a phone.

MIS

Management information system. The regular reports management uses to run the business, such as a monthly pack of profit, cash and people-cost views.

N

NIC code

A code from the National Industrial Classification that describes a company's registered activity. The company's code 722 is software and computer-related services.

O

OCR

Optical character recognition. Software that turns an image of text into searchable, machine-readable text. Key fields still need a human check.

P

Parallel run

Running one full cycle in both the old and the new system or process and comparing the results before switching over.

PDF/A

A version of PDF designed for long-term archiving: fonts and content are embedded so the file displays the same way years later.

Personal data breachLaw

Under the DPDP Act, 2023, any unauthorised processing, accidental disclosure, loss of access or destruction of personal data that compromises its confidentiality, integrity or availability.

R

RBAC

Role-based access control. Access given according to a person's role rather than person by person.

Reconciliation

Checking that two sets of figures that should agree actually do, and explaining every difference in writing.

REST

A common style of web API in which systems exchange data over HTTPS using standard requests.

Retention schedule

A written list of each class of record, how long it is kept, and how it is disposed of at the end.

RPA

Robotic process automation. Software that operates other applications through their screens. Used only where no API or file route exists.

Run log

A record of what ran, on which data, when, with what result and on whose approval.

S

SFTP

SSH File Transfer Protocol. An encrypted way to move files between systems.

Significant data fiduciaryLaw

A data fiduciary the Central Government notifies under the DPDP Act, 2023 as carrying extra duties, such as a data protection officer and periodic data protection impact assessments.

SSO

Single sign-on. One managed sign-in that gives access to several systems, so access can be granted and removed in one place.

T

TLS

Transport Layer Security. The encryption that protects data moving over a network, such as HTTPS web traffic.

Trial load

A full rehearsal of a data load into a test environment, reconciled against the source before the real load.

V

Validation rule

A written check that data must pass before it moves on, such as a format, a total, a duplicate check or a match to master data.

Version control

A system that records every change to code or rules, who made it and why, so any change can be reviewed or reversed.