Data Principal Under DPDP Act 2023

India’s digital economy is expanding rapidly, and with that comes the increasing importance of protecting personal data. The Digital Personal Data Protection Act, 2023 (DPDP Act) is a landmark legislation designed to safeguard the privacy of individuals while enabling lawful data processing. At the centre of this law is the concept of the Data Principal.

This expanded blog dives deeper into the meaning, legal framework, rights, duties, practical impact, challenges, and future relevance of the Data Principal in India’s evolving data governance ecosystem.

Meaning and Legal Identity of Data Principal

A Data Principal is defined as the individual to whom the personal data relates to.  This definition may seem simple, but its implications are profound.

Whenever any entity collects, processes, stores, or shares data that can identify a person, that person becomes the Data Principal in that context.

Example- Ram applies for a job at Google. During the onboarding process, he is required to submit personal details such as his Aadhaar card, financial information, and health-related information.

• Ram is the Data Principal, because the personal data relates to him.
• Google is the Data Fiduciary, because it determines the purpose (employment onboarding) and means of processing this personal data.

Broader Interpretation

The definition is intentionally wide to include:

• Citizens and non-citizens
• Online and offline interactions
• Public and private sector data processing

Representation in Special Cases

• Children: Parents or legal guardians act as Data Principals
• Persons with disabilities: Legal guardians represent them

This ensures inclusivity and protection for vulnerable individuals.

Evolution of the Concept of Data Principal

The idea of a Data Principal is inspired by global privacy frameworks such as:

• EU’s GDPR (where the term “Data Subject” is used)
• OECD privacy principles

However, India has tailored the concept to suit its socio-economic realities, emphasizing:

• Simplicity
• Accessibility
• Digital inclusion

Unlike earlier fragmented rules under the IT Act, the DPDP Act consolidates and strengthens individual rights.

Core Elements That Define a Data Principal

To understand the role fully, we must examine three foundational pillars:

(A) Identity

A Data Principal is always a natural person, not a company or institution.

(B) Data Linkage

The person must be identifiable through:

• Direct identifiers (name, ID)
• Indirect identifiers (location, IP address, behavior patterns)

(C) Relationship with Data Fiduciary

The Data Principal interacts with entities that:

• Decide the purpose of processing (Data Fiduciary)
• Execute processing (Data Processor)

This relationship defines rights and obligations on both sides.

Detailed Rights of a Data Principal

The DPDP Act introduces a rights-based framework empowering individuals.

Right to Information

A Data Principal can demand:

• Summary of Personal Data which is being Processed
• The Identities of all Data Fiducaries and Data Processors to whom Personal Data has been Shared
• Description of Personal Data Shared
• Purpose of collection

Practical Example:

When signing up for an e-commerce platform, you can ask:

• Why is my phone number required?
• Is my data being shared with advertisers?

Exception-   This Exception is applicable where the sharing is based on a written request made by the receiving Data Fiduciary for purposes such as preventing, detecting, or investigating offences or cyber incidents, or for prosecuting or punishing offences.

Right to Correction, Completion, and Erasure

A Data Principle is empowered with the right to correction, completion, updating and erasure of her personal data for the processing for which consent was provided

This right ensures data accuracy and relevance.

Includes:

• Correction of incorrect data
• Completion of partial data
• Deletion when data is no longer needed
• Update the Personal Data

Important Limitation:

Erasure may be denied if:

• Required by law
• Necessary for legal claims

Right to Withdraw Consent 

Consent is not a one-time blanket approval.

Key Features:

• Can be withdrawn anytime
• Must be as easy as giving consent
• No negative consequences beyond processing stoppage

Real-Life Scenario:

You subscribed to a newsletter → Later unsubscribe → Company must stop using your email.

Right to Grievance Redressal (Multi-Layer Mechanism)

Structured Mechanism

A Data Principal shall have the right to have a readily available grievance redressal mechanism provided by a Data Fiduciary or Consent Manager when an act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data 

Timeline

The Data Fidicuary or Consent Manager are obligated to respond to any grievances within a specified period.

Procedure

Step 1:

File complaint with Data Fiduciary

Step 2:

If unresolved → approach Data Protection Board of India

Step 3:

Further legal remedies available

This creates accountability and legal enforceability.

Right to Nominate (Unique Indian Feature)

This is a distinctive feature of Indian law.

A Data Principal can appoint another person to:

• In the Event of Death or Incapacity
• Manage data in case of incapacity

Example:

Nominees can request deletion of social media accounts after death.

Definition of Incapacity

Incapacity refers to a scenario where the Data Principle is unable to exercise his statutory rights under the DPDP Act due to unsoundness of mind or infirmity of body.

Publication of Rights Access Mechanism

The Data Fiduciary or Consent Manager must prominently display on its website or app the methods through which a Data Principal can exercise her rights, along with required identification details.

Procedure to Exercise Rights

The Data Principal may exercise her rights by making a request to the Data Fiduciary using the prescribed means and providing necessary particulars.

Meaning of Identifier

An identifier refers to any unique detail assigned by the Data Fiduciary to identify the Data Principal, such as ID numbers, application references, email address, or mobile number.

Duties of a Data Principal 

Compliance with Applicable Laws

The Data Principal must follow all existing laws while exercising rights under the Act.

Prohibition of Impersonation

The Data Principal must not impersonate another individual when providing personal data.

Duty of Full Disclosure

The Data Principal must not hide or suppress important information when submitting personal data for official documents or identification.

Avoidance of False or Frivolous Complaints

The Data Principal must not file baseless or misleading grievances or complaints.

Submission of Authentic Information

The Data Principal must provide only accurate and verifiable information when requesting correction or erasure of data.

 

Consent Architecture and Data Principal Control

Consent is the backbone of the DPDP Act

Features of Consent Ecosystem:

Application for Registration

Eligible persons may apply to the Board for registration as a Consent Manager by submitting required details, documents, and information as specified.

Scrutiny and Decision by the Board

The Board may examine the application and either grant registration (and publish details) if satisfied, or reject the application with reasons.

Obligations of Consent Manager

Registered Consent Managers must comply with the conditions and obligations specified in the First Schedule.

Monitoring and Compliance Directions

If a Consent Manager fails to comply with prescribed conditions, the Board may issue directions for corrective measures after providing an opportunity to be heard.

Suspension or Cancellation of Registration

The Board may suspend or cancel registration, and issue necessary directions, if required to protect the interests of Data Principals, after giving a hearing.

Power to Seek Information

The Board may require Consent Managers to furnish any information necessary for regulatory purposes.

Role of Data Principal in Different Sectors

Banking Sector

• KYC data
• Transaction monitoring
• Fraud prevention

Healthcare

• Medical records
• Sensitive personal data
• Consent for sharing with insurers

E-commerce

• Purchase history
• Behavioral profiling
• Targeted advertising

Social Media

• Content sharing
• Personal preferences
• Digital identity

In all these sectors, the Data Principal’s rights must be respected.

Children as Data Principals

The Act provides heightened protection:

Verification of Parental Consent

Rule 10 of the DPDP Rules, 2025 mandates that parental or guardian consent must not only be obtained but also verified by the Data Fiduciary.

Modes of Verification

Such verification must be carried out using reliable identity and age details available with the Data Fiduciary, or details voluntarily provided by the individual, either directly or through a virtual token issued by an authorised entity.

Shift from Traditional Consent Mechanisms

Unlike earlier practices where consent was merely indicated through a checkbox, the rule introduces a more robust verification mechanism.

Use of Virtual Tokens and Digital Trail

Consent must be supported by a virtual token linked to identity details, creating a digital trail that ensures authenticity and accountability.

Ensuring Verifiable Parental Consent

By requiring tokens issued by authorised entities such as Digital Locker Service Provider, the rule enhances the credibility and ensures that parental consent is verifiable.

Enforcement Framework

The Data Protection Board of India plays a crucial role.

Functions:

• Adjudication of complaints
• Imposition of penalties
• Ensuring compliance

Penalties:

Can go up to hundreds of crores, depending on:

• Severity of breach
• Nature of data
• Impact on individuals

Real-World Impact of Data Principal Rights

For Individuals:

• Greater control over personal data
• Increased transparency
• Legal backing for privacy

For Businesses:

• Mandatory compliance frameworks
• Investment in data security
• Risk of heavy penalties

For Government:

• Balanced regulation
• Digital trust building
• International alignment

Challenges Faced by Data Principals

Lack of Awareness

Many people do not know their rights under data protection laws. Because of this, they may not take action when their data is misused.

Complexity of Privacy Policies

Privacy policies are often long and written in difficult legal language. Most people do not understand them and simply accept without reading.

Digital Literacy Gap

Some people, especially in rural areas or with less education, may not know how to use digital platforms properly. This makes it hard for them to manage their data or file complaints.

Enforcement Delays

Even if someone raises a complaint, the process may take a long time. This can discourage people from using their rights.

Best Practices for Data Principals

To effectively exercise rights:

Read Privacy Notices Carefully

Before giving consent, always read the privacy notice. It helps you understand what data is being collected, why it is needed, and how it will be used or shared.

Use Consent Dashboards

Many platforms provide consent dashboards where you can manage your permissions. Use these tools to review, give, or withdraw consent easily.

Avoid Oversharing Information

Only share the information that is necessary. Do not provide extra personal details unless it is required for a specific purpose.

Regularly Update Personal Data

Keep your personal information up to date. This ensures accuracy and helps avoid issues while using services or exercising your rights.

File Complaints When Necessary

If you feel your data is misused or your rights are not respected, raise a complaint with the Data Fiduciary or the relevant authority.

Future Outlook

The concept of Data Principal will evolve with:

• AI-driven data processing
• Cross-border data flows
• Privacy-enhancing technologies
• Stronger regulatory frameworks

India is moving toward a privacy-first digital economy, where individuals are not just data sources but active participants.

Conclusion 

The Data Principal is no longer a passive entity in the digital ecosystem. Under the DPDP Act, individuals are empowered with enforceable rights, structured remedies, and meaningful control over their personal data.

However, empowerment must be matched with awareness and responsibility. Only when individuals actively exercise their rights and organizations respect them can the objectives of the law be truly achieved.

The DPDP Act is not just a legal reform—it represents a cultural shift toward data dignity, accountability, and trust.

FAQs

Q1. What is the difference between Data Principal and Data Fiduciary?

A1. A Data Principal is the individual whose data is processed, while a Data Fiduciary is the entity deciding how and why the data is processed.

Q2. Can a Data Principal access all their data?

A2. Yes, subject to certain legal restrictions like national security or legal obligations.

Q3. Is consent always required?

A3. Mostly yes, but there are exceptions such as legal obligations or emergencies.

Q4. Can companies refuse data deletion requests?

A4. Yes, if retention is required by law or necessary for legal claims.

Q5. What happens if a company ignores a Data Principal request?

A5. The individual can escalate the complaint to the Data Protection Board.

Q6. Are offline records covered under the Act?

A6. Yes, if they are digitized or intended to be digitized.

Q7. Can a Data Principal sue for damages?

A7. The Act mainly provides regulatory remedies, but other legal options may exist.

Q8. What is “deemed consent”?

A8. Situations where consent is assumed, such as emergencies or public interest.

Q9. How does the Act protect children?

A9. Through parental consent requirements and restrictions on harmful data practices.

Q10. Is the DPDP Act applicable globally?

A10. It applies to any entity processing data of individuals located in India.