Glossary
What is a Data Principal under DPDP?
The Data Principal is the person the data is about. For a child, or a person with disability who has a lawful guardian, the term also covers the parent or guardian.
Definition
Under s.2 of the DPDP Act, 2023, the Data Principal is the individual to whom the personal data relates. For a child it includes the parents or lawful guardian, and for a person with disability it includes the lawful guardian acting on their behalf. Data Principals hold the rights in ss.11 to 14 and the duties in s.15.
What it means
The Data Principal is the individual behind the record: a customer, an employee, a patient, a student. The Act gives Data Principals rights against Data Fiduciaries and also sets duties for them (s.15).
The definition reaches further for two groups. For a child, who is anyone under 18, it includes the parents or lawful guardian; for a person with disability, the lawful guardian acting for them. Under s.9(1), consent for their data comes from that parent or guardian as verifiable consent.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.2 | Defines the Data Principal, including parents and lawful guardians |
| s.6(4) | May withdraw consent at any time, as easily as it was given |
| s.11 | Right to access information about personal data |
| s.12 | Right to correction, completion, updating and erasure |
| s.13 | Right to grievance redressal |
| s.14 | Right to nominate |
| s.15 | Duties of Data Principals |
| Rule 14 | How requests are made and what identifier is needed |
Common misconceptions
- “Only customers are Data Principals.” Any individual whose personal data you process is one, including employees and job applicants.
- “A Data Principal can complain straight to the Board.” Under s.13(3), they must first exhaust the Data Fiduciary's or Consent Manager's grievance redressal.
- “Data Principals have rights but no duties.” s.15 sets duties for Data Principals too.
Related terms
Decides the purpose and means of processing personal data (s.2).
Data Principal rightsAccess, correction, erasure, grievance redressal and nomination (ss.11 to 14).
ChildAn individual who has not completed eighteen years of age (s.2).
NominationNaming a person to exercise rights on death or incapacity (s.14).
In TruePrivacy
Data Principals can use your branded privacy center to submit requests, manage preferences, check request status and download their data through a secure link. Behind it, Data Principal requests verifies identity before work starts and tracks deadlines, and the grievance desk handles complaints with escalation.
Is a parent a Data Principal?
For a child's personal data, yes. The s.2 definition says the Data Principal includes the parents or lawful guardian of a child, and a child is anyone under 18.
Are employees Data Principals under DPDP?
Yes. Employees are individuals whose personal data an employer processes. Processing for employment purposes can be a legitimate use under s.7(i).
What rights does a Data Principal have?
Access to information (s.11), correction and erasure (s.12), grievance redressal (s.13) and nomination (s.14). Consent can also be withdrawn at any time (s.6(4)).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin