ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXUnderstand who qualifies as a Data Principal under India's DPDPA, the rights they hold, how consent withdrawal works, and how it compares to GDPR's Data Subject.
In simple terms, if an organisation collects or processes personal data about you, you are the Data Principal.
The DPDPA is India's general data-protection law. It governs how organisations handle digital personal data, and the Data Principal is the person those obligations exist to protect.
For example, when you create an account on an online store and enter your name, email address, and delivery address, you are the Data Principal and the store is the Data Fiduciary deciding why and how that information is used.
For a child, the term also includes the child's parent or lawful guardian. For a person with a disability, it includes the lawful guardian acting on that person's behalf.
Data principals have rights under the DPDPA and can exercise control over their personal data in accordance with the Act, including rights relating to access to information, correction and erasure, grievance redressal, and nomination.
A Data Principal is the person whose personal data is being processed.
For example:
In each case, the individual the data relates to may be the Data Principal.
A Data Principal is generally the individual whose personal data is collected, stored, used, shared, or otherwise processed.
For example, consider an e-commerce website:
The customer's name, address, phone number, and other personal data relate to that individual.
The company determines why and how the personal data is processed.
The provider may process the personal data on behalf of the Data Fiduciary.
Understanding these roles is important because each has a different position under the DPDPA.
A Data Principal is the individual the personal data is about.
A Data Fiduciary is the person or organisation that determines the purpose and means of processing that personal data.
Rights requests go to the Data Fiduciary, which stays responsible for processing done by its Data Processors.
For example:
| Role | Example |
|---|---|
| Data Principal | A customer using an online shopping website |
| Data Fiduciary | The company operating the website |
| Data Processor | A cloud provider processing data for the company |
The Data Principal is the person whose privacy interests and rights are protected, while the Data Fiduciary is generally responsible for meeting applicable obligations relating to the processing.
Behind every record an organisation holds is a person. The Data Principal is that person, and how their data is collected, used, and shared is what their privacy actually consists of.
Knowing who the Data Principal is, and what they are entitled to, changes how a business handles personal data day to day. It supports:
Handled this way, privacy is easier to explain to Data Principals and easier to evidence, because the processes that respect people's choices are the same ones that record them.
Section 2(j) of the Digital Personal Data Protection Act, 2023 defines a Data Principal as the individual to whom the personal data relates. Where that individual is a child, the term includes their parent or lawful guardian; where the individual is a person with a disability, it includes their lawful guardian acting on their behalf.
The Act gives Data Principals their rights in Sections 11 to 14, covering access to information, correction and erasure, grievance redressal and nomination, and Section 6 lets them withdraw consent as easily as they gave it.
The DPDPA also sets out duties for Data Principals in Section 15. For example, a Data Principal must not impersonate another person, suppress material information when providing personal data for an official document, or register a false or frivolous grievance, and should give only verifiably authentic information when asking for correction or erasure.
The obligations that make these rights real sit with the Data Fiduciary, and the Data Protection Board of India can inquire into breaches of the Act.
The DPDPA provides Data Principals with rights relating to their personal data.
Depending on the applicable provisions, these include:
A Data Principal can seek certain information about the personal data being processed and related processing activities as provided under the DPDPA.
This can help individuals understand how their personal data is being handled.
A Data Principal may request correction, completion, updating, or erasure of personal data, subject to the applicable requirements and exceptions.
Organisations should have processes for receiving and responding to these requests.
A Data Principal has the right to access a grievance redressal mechanism provided by the Data Fiduciary or Consent Manager.
This provides a process for raising concerns about personal-data processing or the handling of rights requests.
A Data Principal can nominate another individual to exercise applicable rights in certain circumstances specified by the DPDPA.
Where personal data is processed based on consent, a Data Principal can withdraw that consent.
Withdrawal should be as easy as giving consent.
Consent is one of the key ways personal data may be processed under the DPDPA.
Where consent is relied upon, it should meet the applicable requirements under the Act, including being:
The Data Principal should understand the purpose for which consent is being requested.
A strong consent process should make it possible to:
This helps connect the user's decision with the actual processing of personal data.
Where processing is based on consent, a Data Principal should have access to an effective mechanism for withdrawing that consent.
A business should not make withdrawal unnecessarily difficult or materially more complicated than giving consent.
After consent is withdrawn, the Data Fiduciary should take the required steps to stop processing personal data where applicable and manage the consequences of withdrawal in accordance with the DPDPA and other applicable requirements.
For websites and applications, consent withdrawal may involve updating consent preferences and ensuring connected systems respect the revised choice.
The DPDPA provides additional protections for children's personal data.
A child means an individual who has not completed 18 years of age.
The DPDPA also establishes specific requirements concerning the processing of children's personal data, including parental or lawful guardian consent requirements in applicable circumstances and restrictions relating to certain forms of processing.
Businesses that process children's personal data should review the specific requirements that apply to their services.
The statutory definition of Data Principal also addresses situations involving a person with a disability.
This ensures that the DPDPA's framework recognises situations in which personal-data rights and consent-related actions may need to be exercised through an authorised legal representative.
Businesses should provide accessible processes for Data Principals to exercise applicable rights.
A typical workflow may include:
Submit a request through the available privacy or grievance mechanism.
Verify the request where verification is necessary and appropriate.
Identify the relevant personal data and processing activity.
Assess the request under the applicable legal requirements.
Take the required action, such as providing information, correcting data, or erasing data where applicable.
Record the outcome and respond through the appropriate process.
The exact procedure depends on the type of request and the organisation's obligations under the DPDPA.
The term Data Principal is used under India's DPDPA.
The term Data Subject is commonly used under privacy frameworks such as the GDPR.
Both terms generally refer to the individual the personal data relates to, but they belong to different legal frameworks.
| DPDPA | GDPR |
|---|---|
| Data Principal | Data Subject |
| Data Fiduciary | Data Controller |
| Data Processor | Data Processor |
| Consent Manager | No direct equivalent |
Businesses operating internationally should use the terminology and requirements applicable to each privacy framework.
The DPDPA defines a Consent Manager as a registered person that acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
This model is designed to give Data Principals greater control over their consent decisions.
Businesses should distinguish between the statutory concept of a Consent Manager and general consent-management software or a cookie consent banner.
Websites and applications may process personal data through:
Businesses should understand where this data is processed so they can respond effectively when a Data Principal exercises an applicable right.
A privacy request cannot be handled effectively if the organisation does not know where the relevant personal data is stored or which systems and service providers process it.
Businesses processing personal data should consider whether they can:
ConsentX gives every Data Principal a clear way to give, review and withdraw consent, and gives your team a record to show in an audit.
Ask for separate consent for each purpose.
Show plain-language notices before data is collected.
Save a tamper-evident record of every decision.
Let users change their choice as easily as they gave it.
Find trackers and keep non-essential ones off until the user agrees.
Receive, verify and answer access, correction and erasure requests.
Support the rules for children's data.
Keep proof of consent and requests in one place.
Every decision is kept in your consent records, backed by tamper-evident consent receipts you can export for an audit. On your website, cookie and tracker discovery shows which tags are running, and prior blocking keeps non-essential ones off until the user agrees. Region rules let you show Indian visitors a DPDPA-specific experience, and our page on consent for Indian visitors explains how notice, consent and withdrawal work.
This helps organisations move from a static privacy policy to technical systems that can capture, manage, and demonstrate privacy choices.
Start free or book a demo to see it in action.
ConsentX helps businesses collect meaningful consent, manage privacy preferences, support withdrawal, and maintain evidence of Data Principal choices. Start free with ConsentX.
A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data.
A Data Processor processes personal data on behalf of a Data Fiduciary.
India's data-protection framework governing applicable processing of digital personal data.
A registered platform through which a Data Principal can give, manage, review, and withdraw consent.
Software that helps organisations collect, manage, enforce, and document privacy and consent choices.
A consent receipt is a record of a user's consent decision and related information.
Rights available to individuals under the DPDPA, including applicable rights relating to information, correction, erasure, grievance redressal, and nomination.
Cookie consent helps websites collect and manage a user's permission for applicable cookies and tracking technologies.
Prior blocking is the technical process of keeping applicable non-essential trackers inactive until the required consent has been obtained.