Data Principal
The natural person to whom personal data relates under the DPDP Act 2023 — the Indian equivalent of a GDPR data subject.
A Data Principal is defined in Section 2(j) of the Digital Personal Data Protection Act 2023 as "the individual to whom the personal data relates." For a child, the parent or lawful guardian is the Data Principal; for a person with a disability, the lawful guardian acting on their behalf. It is the Indian equivalent of what GDPR terms a data subject.
The Act confers a specific rights framework on Data Principals: the right to information about processing (Section 11), the right to correction and erasure (Section 12), the right to grievance redressal (Section 13), and the right to nominate someone to exercise these rights in the event of death or incapacity (Section 14). Every Data Fiduciary must operationalise these rights within the timelines the DPDP Rules 2025 prescribe.
Data Principals also carry corresponding duties under Section 15 — including not registering false or frivolous grievances, and providing verifiably authentic information when required. Breach of these duties can attract penalties, though as of 2026 the Data Protection Board has not yet exercised this power in a published order.