Glossary
Data principal
The individual to whom personal data relates, who holds the rights under the Digital Personal Data Protection Act, 2023 from 13 May 2027.
Under section 2(j) of the Digital Personal Data Protection Act, 2023, a data principal is the individual to whom personal data relates. Where the individual is a child or a person with a disability acting through a lawful guardian, the same clause treats the parent or guardian as the data principal. The rights the Act gives, in sections 11 to 14, belong to the data principal.
Those rights and the matching duties start on 13 May 2027. From then a data principal must receive a notice in clear and plain language that allows specific and informed consent, must be able to withdraw consent as easily as she gave it, must be told of a personal data breach that affects her, and, where the erasure rule applies, must be told at least forty-eight hours before her data is deleted. The dates are stated as at 13 November 2025.
Used in
- A telemedicine product in India answers to three regulators at once, and only the doctor may prescribe
- Location and driving data from a vehicle telematics device is personal data under the DPDP Act from 13 May 2027
- The DPDP Rules are notified, and almost nothing in them binds until 13 May 2027
- The DPDP exemption for schools and universities covers tracking and behavioural monitoring, not every use of a student's data
Sources
- ActThe Digital Personal Data Protection Act, 2023 (No. 22 of 2023)meity.gov.inOn this site: The Digital Personal Data Protection Act, 2023
- RulesDigital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025, Gazette of India Extraordinary, Part II, Section 3, Sub-section (i), Ministry of Electronics and Information Technologymeity.gov.inOn this site: Digital Personal Data Protection Rules, 2025
Cite this termData principal. Juris Eagle glossary. Stated as at 13 November 2025. https://juriseagle.com/glossary/data-principal