What is a Data Principal?
A Data Principal is the individual that the personal data is about. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), that’s you — whenever a business holds your name, phone number, email, Aadhaar, PAN, or anything else that identifies you.
Educational resource only — not legal advice.
For a child (anyone under 18), the Data Principal includes the parent or lawful guardian; for a person with a disability, it includes their lawful guardian. The DPDP Act is built around protecting the Data Principal — it gives you rights (access, correction, erasure, grievance redressal, and nomination) and makes consent yours to give or withdraw.
Why it matters to you. Knowing you’re a Data Principal tells you what you can ask of any organisation holding your data: to show you what they have, correct it, delete it, or stop using it. These are rights, not favours.
What it is not. A Data Principal is not a Data Fiduciary (the organisation that decides why and how the data is used). The same person can be both in different contexts — a freelancer is a Data Principal to their own bank, and a Data Fiduciary to the clients whose data they collect.
Collecting personal data from your own customers?
These are the rights your business has to honour. See where you stand with a two-minute self-check — no sign-up, no data stored.
Run the compliance self-check →