Data Subject
The GDPR term for the individual the data is about. The DPDP term is Data Principal.
A data subject is the GDPR name for the person the data is about. The DPDP Act calls this person the Data Principal, a term that also covers parents and guardians in some cases.
Meaning of Data Subject
The two are not identical: the Data Principal includes the parent or lawful guardian of a child and the lawful guardian of a person with a disability.
In GDPR Article 4(1), a data subject is an identified or identifiable natural person to whom personal data relates. The DPDP Act uses Data Principal, defined in Section 2 as the individual to whom the personal data relates. For a child, the definition includes the parents or lawful guardian, and for a person with a disability, it includes the lawful guardian acting on her behalf. When a global document says "data subject", translate it to Data Principal for Indian processing.
The choice of "principal" is meaningful. The Act treats the individual as the party who owns the relationship and gives instructions, with the organisation acting as a fiduciary in a position of trust. The Data Principal has rights to information about the personal data being processed and with whom it is shared (Section 11), to correction, completion, updating and erasure (Section 12), to grievance redressal (Section 13) and to nominate another person who can exercise rights in case of death or incapacity (Section 14). Section 15 places duties on the Data Principal too, such as not filing false or frivolous complaints and not impersonating another person, with a penalty up to ₹10,000 for breach.
The scope differs between the regimes. GDPR does not apply to deceased persons, leaving that to national law, while the DPDP Act's nomination right under Section 14 lets a Data Principal name someone to exercise her rights if she dies or becomes incapable. GDPR gives data subjects extra rights, including portability and the right to object, that the DPDP Act does not provide. The DPDP Act also makes the manner of exercising rights part of the Rules: under Rule 14, a fiduciary must publish the means by which a Data Principal can make requests, and the Rules deal with how nominations are made.
Children are a particular feature. A Data Principal below 18 needs verifiable consent from a parent or lawful guardian before her data is processed (Section 9), and Rules 10 and 11 describe how that verification works. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited. Where a parent exercises rights for a child, the fiduciary should confirm the relationship before acting, so the process does not become a route for unauthorised access.
Examples of Data Subject
A global privacy notice says "data subject". For India, rewrite it as "Data Principal" and name the rights available under the Act.
A customer writes asking which of her personal data the bank holds and with whom it is shared. The bank treats her as a Data Principal, verifies her identity and gives a summary of the data and the entities it has been shared with under Section 11.
A parent asks a school app to correct his daughter's date of birth. The school checks his relationship, treats the request as one made for the child, and updates the record under Section 12.
A user nominates her sister to manage her account if she becomes unable to do so. The platform records the nomination and explains how the sister can later make a request, with proof of the circumstances.
Why Data Subject matters
Using the wrong term is not just a language issue. A privacy notice that speaks of data subjects and lists GDPR rights misleads Indian users about what they can do and may omit what the Indian Rules require, such as the complaint route to the Board and the nomination right. A mismatch of this kind can cost trust and, if the notice is deficient, attract regulatory attention.
For individuals, understanding the Data Principal framework tells you what you can ask for and what you must do. A person who files vexatious complaints, or gives false information to obtain a benefit, can be penalised under the Schedule, so the framework carries responsibilities as well as rights.
How it works in practice
- 1Rewrite global privacy notices for India. Replace "data subject" with "Data Principal" and list the rights the Act actually gives, with instructions for exercising each of them.
- 2Publish the means for requests as Rule 14 expects, for example a web form or email address, along with the information a person must provide to be identified, and the time in which you will respond.
- 3Build a verification step for requests made by parents, guardians or nominees. Ask for documents proportionate to the request and keep a record of what you checked.
- 4Create a nomination feature in your account settings so users can name a person to exercise their rights in the event of death or incapacity.
- 5Track Data Principal requests in a register with dates, outcome and reason for refusal, to be ready to answer a Board query.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating the terms as identical. The Data Principal includes parents and guardians in specific cases and has a different rights bundle.
Promising GDPR rights in India. Do not list portability or objection as legal rights under the Act.
Accepting requests without verification. Verify identity and authority, especially for children and nominees.
Overlooking duties of the Data Principal. The Act expects truthful information and non-frivolous complaints.
Compliance tips
Write rights information in plain language and keep it short. Rule 3 expects clarity.
Offer the same ease for exercising a right as for giving consent, so people are not discouraged.
Train support staff to recognise rights requests whatever words the person uses.
Review your request process annually against the Rules and any Board guidance.
Common questions about Data Subject
Is a data subject the same as a Data Principal?
They are close equivalents, both meaning the person the data is about. The DPDP Act's Data Principal also includes the parent or lawful guardian of a child, and the lawful guardian of a person with a disability, which GDPR's data subject does not.
What rights does a Data Principal have in India?
Under the Act: information about the personal data processed and its sharing, correction and erasure, grievance redressal, and the [right to nominate](term/right-to-nominate) another person. A person who consented can also withdraw consent. GDPR rights like portability are not included.
Does a Data Principal have duties?
Yes. Section 15 asks Data Principals to comply with the law, not impersonate others, not suppress material information, not file false or frivolous complaints and furnish only verifiable authentic information. Breach of these duties attracts a penalty up to ₹10,000.
Can someone exercise rights for a deceased person?
Under Section 14 a Data Principal can nominate a person to exercise rights if she dies or becomes incapacitated. Without a nomination, the position depends on the Rules and general law, so take advice for particular cases.