Data Principal
The individual to whom personal data relates, as defined under India's DPDP Act (equivalent to 'data subject' under GDPR).
Full Definition
Under India's Digital Personal Data Protection Act 2023, the 'Data Principal' is the individual whose personal data is being processed. This is the Indian law equivalent of the 'Data Subject' under GDPR. Data Principals have rights under the DPDP Act including the right to access information about their data, the right to correction and erasure, the right to grievance redressal, and the right to nominate a representative. Data Principals can exercise these rights against the Data Fiduciary. Parental consent is required for processing data of children under 18.
How each law treats it
The individual to whom the personal data relates. DPDP's equivalent of GDPR 'data subject' or CCPA 'consumer'.
Data Principals hold rights of access, correction/erasure, grievance redressal and nomination (so another individual can exercise the rights on their behalf after death or incapacity).
The equivalent GDPR concept is 'data subject' — any identified or identifiable natural person.
In practice
- Build the DSR intake assuming the Data Principal may be a nominee acting under Section 14. Capture the nomination evidence as part of identity verification.
- Children are Data Principals too — DPDP additionally requires verifiable parental consent for every under-18.
- The Data Principal's language choice drives the notice format — accept the Eighth Schedule language they select on the request form.
Common pitfalls
- Treating 'customer' and 'Data Principal' as the same thing. Non-customers whose data you process (employees, applicants, vendors' staff, children of customers) are also Data Principals.
- Ignoring the Section 14 nomination path. A nomination carries legal effect only if your intake system can accept one.
- Charging a fee for exercising rights — DPDP does not permit a fee for a legitimate rights request.
Frequently asked questions
Can a Data Principal exercise rights for someone else?+
Yes via nomination under Section 14 (for death or incapacity) or by granting an authorised agent. Each pathway requires identity + authority evidence.
What are a Data Principal's duties?+
DPDP Section 15 imposes duties — not impersonating others, not withholding information, not filing frivolous grievances. The duties are a legal backstop, not a reason to refuse legitimate requests.
How do children's rights work?+
Under 18, the parent or guardian exercises the Data Principal's rights. Over 18, the individual exercises their own rights directly — no transition date is prescribed; it's immediate.
Related terms
Data Subject
An identified or identifiable natural person whose personal data is being processed.
Data Fiduciary
The Indian equivalent of a Data Controller under the DPDP Act — an entity that determines the purposes and means of processing personal data.
Right to Access
A data subject's right to obtain confirmation of whether their personal data is being processed and to receive a copy of it.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes