Rights & Ethics

Data Principal

Entity to whom the data relates (individual, community, or company).

How the laws define this

Both regulatory frameworks agree that a Data Principal is the central entity to whom data relates, serving as the primary beneficiary of data protections, access rights, and grievance redress mechanisms. The critical point of divergence lies in who can hold this status and what type of data is involved. Under the Digital Personal Data Protection Act, 2023, a Data Principal is strictly defined as a natural person whose digital personal data is processed, holding specific statutory rights such as access, correction, and erasure. Conversely, the Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee) expands this definition to encompass non-personal data and extends eligibility beyond individuals to include recognised communities and companies. While the former focuses on individual protections over digital personal data, the latter acknowledges broader community interests and access mechanisms for non-personal data.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
India	Digital Personal Data Protection Act, 2023	Awaiting Entry	Limits Data Principal to natural persons only, excluding communities or companies, and emphasizes rights like access, correction, erasure, and grievance redress under the DPDP Act.
India	Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee)	Under Review	Widens Data Principal to include individuals, recognised communities, or companies, and highlights interests in non-personal data with potential access and redress mechanisms.

What it triggers

Under the DPDP Act, the Data Principal is afforded rights such as access, correction, erasure and grievance redress.
The Gopalakrishnan Committee Report recognises Data Principals as having interests in non-personal data and as potential beneficiaries of access and redress mechanisms.

Definitions (2)

A Data Principal is the entity — which may be an individual, a recognised community, or a company — to whom the data relates; the Report recognises principals as having interests in NPD (including community interests) and as potential beneficiaries of access/redress mechanisms.

Report by the Committee of Experts on Non-Personal Data Governance Framework (Gopalakrishnan Committee)Definition 1 of 2

The natural person whose digital personal data is processed and who is afforded rights under the Act (such as access, correction, erasure and grievance redress); the primary beneficiary of the statutory protections.

Digital Personal Data Protection Act, 2023Definition 2 of 2

Not to be confused with

data owner

Data owner refers to the official accountable for data value and classification, while Data Principal is the entity to whom the data relates.

data trustee

Data trustee is a neutral intermediary managing rights, consent and access, whereas Data Principal is the entity whose data is involved.

data holder

Data holder is the authority that legally collects and maintains the dataset, distinct from Data Principal as the data subject.

Questions and answers

What rights does a Data Principal have under the DPDP Act?

The Data Principal is afforded rights such as access, correction, erasure and grievance redress. They are the primary beneficiary of the statutory protections.

Can a company be a Data Principal?

Under the Gopalakrishnan Committee Report, a Data Principal can be an individual, a recognised community, or a company.

How does Data Principal differ from data owner or data holder?

Data Principal is the entity to whom the data relates, while data owner handles value and classification, data trustee manages access, and data holder collects and maintains data.