Data Principal
Under Section 2(j) of the DPDP Act, 2023, the individual to whom personal data relates, including the parents or lawful guardian of a child and the lawful guardian of a person with disability.
Explained
Section 2(j) of the Digital Personal Data Protection Act, 2023 defines Data Principal as the individual to whom the personal data relates. Where the individual is a child, the expression includes the parents or lawful guardian of the child, and where the individual is a person with disability, it includes her lawful guardian acting on her behalf. A child is an individual who has not completed eighteen years under Section 2(f), and personal data is any data about an individual who is identifiable by or in relation to it under Section 2(t).
The Data Principal is the person whose data is processed. The Data Fiduciary, under Section 2(i), is the person who alone or with others determines the purpose and means of processing, and the Data Processor processes data on its behalf. Only an individual can be a Data Principal; a company cannot.
The Act gives the Data Principal control through consent and rights. Consent under Section 6 must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, limited to the data necessary for the specified purpose, and can be withdrawn. Sections 11 to 14 give the rights to access information about personal data, to correction and erasure, to grievance redressal and to nominate another individual to exercise the rights on death or incapacity. Under Section 13(3), the Data Principal must exhaust the grievance redressal mechanism of the Data Fiduciary or Consent Manager before approaching the Data Protection Board.
Unusually, the Act also imposes duties. Section 15 requires the Data Principal to comply with applicable laws, not to impersonate another person, not to suppress material information when providing data for State-issued documents, not to file false or frivolous grievances, and to furnish only verifiably authentic information when seeking correction or erasure. Examiners test the inclusion of parents and guardians, the rights in Sections 11 to 14, the exhaustion rule and the duties.
What the law says
(j) “Data Principal” means the individual to whom the personal data relates and where such individual is—
(i) a child, includes the parents or lawful guardian of such a child;
(ii) a person with disability, includes her lawful guardian, acting on her behalf;
Clause (j) defines Data Principal; clauses (f), (i) and (t) related terms
(1) The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Illustration.
X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.
Requirements of valid consent
(1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder.
(2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries.
(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.
Grievance redressal and exhaustion before the Board
A Data Principal shall perform the following duties, namely:—
(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
(b) to ensure not to impersonate another person while providing her personal data for a specified purpose;
Duties of Data Principal
(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—
(a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
(b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
Right to access information about personal data
Example
Illustration to Section 6(1): X downloads a telemedicine app, Y, and consents to processing for telemedicine services and to access to her phone contact list. Since the contact list is not necessary, her consent is limited to processing for telemedicine services.
For the exam
- Section 2(j): includes parents or lawful guardian of a child, and guardian of a person with disability.
- Only an individual can be a Data Principal; the Data Fiduciary decides purpose and means.
- Rights: access, correction and erasure, grievance redressal, nomination (Sections 11 to 14).
- Must exhaust the Data Fiduciary's grievance mechanism before the Board (Section 13(3)).
- Duties of the Data Principal are in Section 15.
12 questions in the Law Maker question bank use this term. Practise Cyber Law questions
Related terms
- Personal dataAny data about an individual who is identifiable by or in relation to such data. Section 2(t) of the Digital Personal Data Protection Act, 2023.
- Data FiduciaryUnder Section 2(i) of the DPDP Act, 2023, any person who alone or with others determines the purpose and means of processing personal data. It bears primary responsibility for compliance.
- ChildUnder Section 2(3) of the BNS a child is any person below eighteen years of age. Special statutes use the same age with small variations, and child marriage law sets twenty one for males.
- GuardianA person having the care of the person of a minor, or of his property, or of both. Defined in Section 4(b) of the HMGA and Section 4(2) of the Guardians and Wards Act.
- IntermediaryA person who, on behalf of another, receives, stores or transmits an electronic record or provides a service for it, such as an internet provider, search engine or online marketplace. Section 2(1)(w) IT Act.
Further reading
Checked 6 November 2026. Statutory text is quoted from the Bare Acts library, taken from India Code. See the full glossary.