What is a Data Principal under the DPDP Act?
A Data Principal is the individual to whom personal data relates. Where the individual is a child, it includes their parent or lawful guardian; where the individual is a person with disability, it includes their lawful guardian. Data Principals hold rights of access, correction and erasure, the right to grievance redressal, and the right to nominate another person to exercise their rights.
These rights are time-bound in practice: an organisation that cannot receive, route and answer a request inside the prescribed period has a compliance failure regardless of how well the rest of its programme runs.
The Act also places duties on Data Principals, including not impersonating another person and not filing false or frivolous complaints.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →