What is a Data Principal under India's DPDPA?
Understand who qualifies as a Data Principal under India's DPDPA, the rights they hold, how consent withdrawal works, and how it compares to GDPR's Data Subject.
In simple terms, if an organisation collects or processes personal data about you, you are the Data Principal.
The DPDPA is India's general data-protection law. It governs how organisations handle digital personal data, and the Data Principal is the person those obligations exist to protect.
For example, when you create an account on an online store and enter your name, email address, and delivery address, you are the Data Principal and the store is the Data Fiduciary deciding why and how that information is used.
For a child, the term also includes the child's parent or lawful guardian. For a person with a disability, it includes the lawful guardian acting on that person's behalf.
Data principals have rights under the DPDPA and can exercise control over their personal data in accordance with the Act, including rights relating to access to information, correction and erasure, grievance redressal, and nomination.
What Does Data Principal Mean?
A Data Principal is the person whose personal data is being processed.
For example:
- A customer whose name and email are collected by an online store
- A user who creates an account on a SaaS platform
- A patient whose digital information is processed by an online healthcare service
- An employee whose personal information is processed digitally
- A website visitor whose personal data is collected through an online form
In each case, the individual the data relates to may be the Data Principal.
Who Is a Data Principal Under the DPDPA?
A Data Principal is generally the individual whose personal data is collected, stored, used, shared, or otherwise processed.
For example, consider an e-commerce website:
Customer
Data PrincipalThe customer's name, address, phone number, and other personal data relate to that individual.
Company
Data FiduciaryThe company determines why and how the personal data is processed.
Service Provider
Data ProcessorThe provider may process the personal data on behalf of the Data Fiduciary.
Understanding these roles is important because each has a different position under the DPDPA.
Data Principal vs Data Fiduciary
A Data Principal is the individual the personal data is about.
A Data Fiduciary is the person or organisation that determines the purpose and means of processing that personal data.
Rights requests go to the Data Fiduciary, which stays responsible for processing done by its Data Processors.
For example:
| Role | Example |
|---|---|
| Data Principal | A customer using an online shopping website |
| Data Fiduciary | The company operating the website |
| Data Processor | A cloud provider processing data for the company |
The Data Principal is the person whose privacy interests and rights are protected, while the Data Fiduciary is generally responsible for meeting applicable obligations relating to the processing.
Why Data Principal Privacy Matters Under the DPDPA
Behind every record an organisation holds is a person. The Data Principal is that person, and how their data is collected, used, and shared is what their privacy actually consists of.
Knowing who the Data Principal is, and what they are entitled to, changes how a business handles personal data day to day. It supports:
- Individual control over personal data
- Transparency about what is collected and why
- Purpose-limited, responsible processing
- Choices that are real rather than formalities
- Clear routes for people to act on their rights
- A practical basis for DPDPA compliance
Handled this way, privacy is easier to explain to Data Principals and easier to evidence, because the processes that respect people's choices are the same ones that record them.
Legal Basis: What the DPDP Act Says
Section 2(j) of the Digital Personal Data Protection Act, 2023 defines a Data Principal as the individual to whom the personal data relates. Where that individual is a child, the term includes their parent or lawful guardian; where the individual is a person with a disability, it includes their lawful guardian acting on their behalf.
The Act gives Data Principals their rights in Sections 11 to 14, covering access to information, correction and erasure, grievance redressal and nomination, and Section 6 lets them withdraw consent as easily as they gave it.
The DPDPA also sets out duties for Data Principals in Section 15. For example, a Data Principal must not impersonate another person, suppress material information when providing personal data for an official document, or register a false or frivolous grievance, and should give only verifiably authentic information when asking for correction or erasure.
The obligations that make these rights real sit with the Data Fiduciary, and the Data Protection Board of India can inquire into breaches of the Act.
Rights of a Data Principal
The DPDPA provides Data Principals with rights relating to their personal data.
Depending on the applicable provisions, these include:
Right to access information
A Data Principal can seek certain information about the personal data being processed and related processing activities as provided under the DPDPA.
This can help individuals understand how their personal data is being handled.
Right to correction and erasure
A Data Principal may request correction, completion, updating, or erasure of personal data, subject to the applicable requirements and exceptions.
Organisations should have processes for receiving and responding to these requests.
Right of grievance redressal
A Data Principal has the right to access a grievance redressal mechanism provided by the Data Fiduciary or Consent Manager.
This provides a process for raising concerns about personal-data processing or the handling of rights requests.
Right to nominate
A Data Principal can nominate another individual to exercise applicable rights in certain circumstances specified by the DPDPA.
Right to withdraw consent
Where personal data is processed based on consent, a Data Principal can withdraw that consent.
Withdrawal should be as easy as giving consent.
Consent and How to Withdraw It
Consent is one of the key ways personal data may be processed under the DPDPA.
Where consent is relied upon, it should meet the applicable requirements under the Act, including being:
- Free
- Specific
- Informed
- Unconditional
- Unambiguous
- Given through clear affirmative action
The Data Principal should understand the purpose for which consent is being requested.
A strong consent process should make it possible to:
- Inform
- Ask
- Capture
- Record
- Enforce
- Withdraw
This helps connect the user's decision with the actual processing of personal data.
How can a Data Principal withdraw consent?
Where processing is based on consent, a Data Principal should have access to an effective mechanism for withdrawing that consent.
A business should not make withdrawal unnecessarily difficult or materially more complicated than giving consent.
After consent is withdrawn, the Data Fiduciary should take the required steps to stop processing personal data where applicable and manage the consequences of withdrawal in accordance with the DPDPA and other applicable requirements.
For websites and applications, consent withdrawal may involve updating consent preferences and ensuring connected systems respect the revised choice.
Children and Persons With Disabilities
Data Principal and children's data
The DPDPA provides additional protections for children's personal data.
A child means an individual who has not completed 18 years of age.
The DPDPA also establishes specific requirements concerning the processing of children's personal data, including parental or lawful guardian consent requirements in applicable circumstances and restrictions relating to certain forms of processing.
Businesses that process children's personal data should review the specific requirements that apply to their services.
Data Principal and persons with disabilities
The statutory definition of Data Principal also addresses situations involving a person with a disability.
This ensures that the DPDPA's framework recognises situations in which personal-data rights and consent-related actions may need to be exercised through an authorised legal representative.
How a Data Principal Exercises Their Rights
Businesses should provide accessible processes for Data Principals to exercise applicable rights.
A typical workflow may include:
Submit
Submit a request through the available privacy or grievance mechanism.
Verify
Verify the request where verification is necessary and appropriate.
Identify
Identify the relevant personal data and processing activity.
Assess
Assess the request under the applicable legal requirements.
Act
Take the required action, such as providing information, correcting data, or erasing data where applicable.
Record
Record the outcome and respond through the appropriate process.
The exact procedure depends on the type of request and the organisation's obligations under the DPDPA.
Data Principal vs Data Subject, and the Consent Manager
The term Data Principal is used under India's DPDPA.
The term Data Subject is commonly used under privacy frameworks such as the GDPR.
Both terms generally refer to the individual the personal data relates to, but they belong to different legal frameworks.
| DPDPA | GDPR |
|---|---|
| Data Principal | Data Subject |
| Data Fiduciary | Data Controller |
| Data Processor | Data Processor |
| Consent Manager | No direct equivalent |
Businesses operating internationally should use the terminology and requirements applicable to each privacy framework.
Data Principal and a Consent Manager
The DPDPA defines a Consent Manager as a registered person that acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
This model is designed to give Data Principals greater control over their consent decisions.
Businesses should distinguish between the statutory concept of a Consent Manager and general consent-management software or a cookie consent banner.
Compliance Checklist for Businesses
Websites and applications may process personal data through:
- Account registration
- Contact forms
- Newsletter subscriptions
- Purchases and payments
- Customer-support systems
- Mobile app usage
- Cookies and online identifiers
- Analytics tools
- Advertising technologies
- Other third-party services
Businesses should understand where this data is processed so they can respond effectively when a Data Principal exercises an applicable right.
A privacy request cannot be handled effectively if the organisation does not know where the relevant personal data is stored or which systems and service providers process it.
Businesses processing personal data should consider whether they can:
- Identify the relevant Data Principals
- Provide clear privacy and consent notices
- Explain applicable processing purposes
- Capture valid consent where required
- Record consent decisions
- Support consent withdrawal
- Locate relevant personal data
- Correct or update data where required
- Erase data where applicable
- Provide grievance-redressal mechanisms
- Handle children's personal data appropriately
- Manage requests made through applicable representatives
- Maintain records of requests and responses
- Ensure connected systems respect updated privacy choices
How ConsentX Helps You Respect Data Principal Rights
ConsentX gives every Data Principal a clear way to give, review and withdraw consent, and gives your team a record to show in an audit.
Purpose-based consent
Ask for separate consent for each purpose.
Clear notices
Show plain-language notices before data is collected.
Consent receipts
Save a tamper-evident record of every decision.
Withdrawal
Let users change their choice as easily as they gave it.
Cookie discovery and prior blocking
Find trackers and keep non-essential ones off until the user agrees.
Rights request workflows
Receive, verify and answer access, correction and erasure requests.
Age-gating and parental consent
Support the rules for children's data.
Audit-ready evidence
Keep proof of consent and requests in one place.
Every decision is kept in your consent records, backed by tamper-evident consent receipts you can export for an audit. On your website, cookie and tracker discovery shows which tags are running, and prior blocking keeps non-essential ones off until the user agrees. Region rules let you show Indian visitors a DPDPA-specific experience, and our page on consent for Indian visitors explains how notice, consent and withdrawal work.
This helps organisations move from a static privacy policy to technical systems that can capture, manage, and demonstrate privacy choices.
Start free or book a demo to see it in action.
Put Data Principal rights into practice
ConsentX helps businesses collect meaningful consent, manage privacy preferences, support withdrawal, and maintain evidence of Data Principal choices. Start free with ConsentX.
Related Terms
A Data Fiduciary is the person or organisation that determines the purpose and means of processing personal data.
A Data Processor processes personal data on behalf of a Data Fiduciary.
India's data-protection framework governing applicable processing of digital personal data.
A registered platform through which a Data Principal can give, manage, review, and withdraw consent.
Software that helps organisations collect, manage, enforce, and document privacy and consent choices.
A consent receipt is a record of a user's consent decision and related information.
Rights available to individuals under the DPDPA, including applicable rights relating to information, correction, erasure, grievance redressal, and nomination.
Cookie consent helps websites collect and manage a user's permission for applicable cookies and tracking technologies.
Prior blocking is the technical process of keeping applicable non-essential trackers inactive until the required consent has been obtained.