The data principal is the person at the centre of every DPDP obligation.

If the data describes you, you are its data principal. The DPDP Act gives that person rights over the data and a few duties of their own. For a child under eighteen, the parent or lawful guardian is treated as part of the principal, and the same goes for a lawful guardian acting for a person with a disability.

Every right in the Act belongs to the data principal: to get a summary of what is processed and who it was shared with, to correct, complete, update or erase it, to use a grievance process, and to nominate someone to act if they die or cannot act. The DPDP Rules, 2025 ask fiduciaries to publish how to make a request and to answer grievances within a period they publish, which cannot exceed ninety days. Unusually, the Act also gives principals duties: not to impersonate others, not to file false or frivolous complaints, and to give authentic information when asking for a correction. Breaching those duties carries a ceiling of ten thousand rupees.

The rights request page

The page or in-app form where people ask for access, correction or erasure, with the identifier you need to find their records.

A grievance ticket

Each complaint from a principal, the response and the date, kept as evidence that the published window was met.

Sign-up and consent screens

Where you decide whether the user is a child, and so whether a parent must give verifiable consent.

A complaint before the Board

A principal must normally use your grievance process first before going to the Data Protection Board of India.

Data subject

The GDPR's term for the person the data relates to. The DPDP Act adds guardians into the definition and gives the person duties too.

Consent manager

A registered platform a principal can use to give, review and withdraw consent. It acts for the principal but is not the principal.

• Publish one clear route for rights requests and say what identifier you need.
• Publish your grievance response period and make sure it stays within ninety days.
• Decide how you will spot a child at sign-up and how you will verify the parent.
• Record nominations so a nominee can act when the principal cannot.

• GuideData principal rights, and running requestsThe rights people hold, and a workflow that answers them.
• GuideChildren's data and parental consentVerifiable consent, the limits on tracking, and the exemptions.
• GuideValid consent and noticesWhat a notice says and what makes consent count.

Sources: Digital Personal Data Protection Act, 2023, sections 2, 9, 11 to 15 and the Schedule; Digital Personal Data Protection Rules, 2025, rules 10 and 14. Not legal advice.