Data Principal
The individual to whom the personal data relates. In the Act's wording, the person whose data it is.
The Data Principal is the person the personal data is about. It is the individual whose rights the DPDP Act exists to protect.
Meaning of Data Principal
For a child, the Data Principal includes the parent or lawful guardian. For a person with a disability who has a lawful guardian, it includes that guardian. Data Principals have rights to access information, correct and erase data, seek grievance redressal and nominate another person, and they also have duties.
Section 2(j) of the DPDP Act defines the Data Principal as the individual to whom the personal data relates. Where that individual is a child, the term includes the parent or lawful guardian. Where the individual is a person with a disability who has a lawful guardian, it includes that lawful guardian acting on the person's behalf. Rule 10 and Rule 11 set out how organisations must verify these guardians before relying on consent.
The Act gives the Data Principal a set of rights and a short list of duties. Rights include access to a summary of personal data and processing under Section 11, correction, completion, updating and erasure under Section 12, grievance redressal under Section 13, and nomination of another person to exercise rights on death or incapacity under Section 14. Rule 14 expects every Data Fiduciary to publish how these rights can be exercised.
Duties are in Section 15. A Data Principal must comply with applicable laws, must not impersonate another person, must not suppress material information when providing personal data for official documents, must not register a false or frivolous grievance or complaint, and must furnish verifiably authentic information when exercising the right to correction or erasure. A breach of these duties can attract a penalty of up to ₹10,000 under the Schedule, which is meant as a safeguard against abuse of the system.
The Data Principal is a different concept from the "data subject" in the EU's GDPR, although they play the same role. Only natural persons are Data Principals. A company, a trust or a partnership is not a Data Principal, even when the data relates to its business. The people behind it, such as directors, employees and signatories, are Data Principals for their own personal data.
Examples of Data Principal
A shopper who creates an account on an online store is the Data Principal for the account data the store holds about them.
A bank customer uses the app to ask what personal data the bank holds and for what purposes. The bank treats her as a Data Principal and replies using its published rights process, after checking her identity through the registered mobile number.
A school collects data on a 14-year-old student. The child is a minor, so the school treats the parent or lawful guardian as the Data Principal for consent, verifies the parent's identity and avoids tracking or [targeted advertising](term/targeted-advertising) directed at the child.
An employee asks HR to correct a wrong date of birth in the payroll file. HR confirms the employee as the Data Principal, collects a supporting document, updates the record and informs the payroll vendor, which holds a copy as a processor.
Why Data Principal matters
Every obligation of a Data Fiduciary flows toward the Data Principal. Who qualifies as a Data Principal decides who must receive a notice, whose consent is needed, who may withdraw it and who can complain to the Board. Getting this wrong, for example by taking a child's consent instead of the parent's, can attract a penalty of up to ₹200 crore under the children's obligations in the Schedule.
For individuals, understanding the term helps them use their rights effectively and know that a guardian or nominee can act when they cannot. Knowing the duties also matters: a false complaint to the Board can lead to costs or a warning under Section 28(12) and a penalty under the Schedule.
How it works in practice
- 1For organisations, identify the Data Principal for each data flow: customers, employees, job applicants, website visitors, students, patients and parents. Each group may need a different notice and channel.
- 2Set up a rights-request process. Publish an easy route, such as a web form or dedicated email, verify the identity of the requester without demanding extra personal data, and track response times.
- 3Build guardian workflows for children and for persons with disabilities who have lawful guardians, including identity and relationship checks under Rules 10 and 11.
- 4Offer a nomination option in the account settings so that a Data Principal can name someone to exercise rights if she dies or becomes incapable, as Section 14 allows.
- 5For individuals, keep copies of notices and consents, use the grievance route of the organisation first, and approach the Board only after that, using accurate and complete information.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Using the term "customer" and ignoring other Data Principals such as job applicants, visitors and former employees. Rights apply to all of them.
Believing a company can be a Data Principal. Only individuals can; business contact persons are Data Principals for their own details.
Forgetting that a child's parent or guardian acts as the Data Principal for consent purposes. Self-declared adulthood is not enough where reliable checks are possible.
Asking for excessive ID proof to verify a request. Verification should be proportionate and should not create new privacy risk.
Compliance tips
Keep a plain-language rights page that explains each right, shows the form and gives expected turnaround times.
Train frontline teams to recognise rights requests in emails, chats and calls, and route them to the privacy owner.
Log every request with date, type, decision and reason so you can prove compliance later.
Remind individuals of their Section 15 duties in the grievance form, so frivolous or false complaints are discouraged.
Common questions about Data Principal
Who is a Data Principal under the DPDP Act?
The individual whose personal data is being processed. For a child it includes the parent or lawful guardian, and for a person with a disability with a lawful guardian it includes the guardian. Companies and other legal entities are not Data Principals.
Is a Data Principal the same as a data subject?
They play the same role. "Data subject" is the GDPR term, while the DPDP Act uses Data Principal. The rights differ in detail, so do not assume GDPR practices automatically meet Indian requirements.
What rights does a Data Principal have?
Rights to access information under Section 11, correction and erasure under Section 12, grievance redressal under Section 13, and nomination under Section 14. Consent can also be withdrawn at any time where it is the ground of processing.
Does a Data Principal have any duties?
Yes. Section 15 asks her to follow applicable laws, not impersonate others, not suppress material information, not file false complaints and give authentic information when correcting or erasing data. Breach of duties can lead to a penalty up to ₹10,000.