Data principal The person the data is about: the client, patient, student or employee.
Short answer. A data principal is the individual to whom personal data relates, under section 2(j) of India’s Digital Personal Data Protection Act, 2023. For a child, the term includes the parents or lawful guardian, and for a person with a disability it includes a lawful guardian acting on her behalf. In an office, data principals are the clients, patients, students, employees and visitors whose details sit in files and systems. The Act gives them a right to information about processing (section 11), to correction and erasure (section 12), to grievance redressal (section 13) and to nominate someone (section 14), and it places a few duties on them (section 15). The DPDP Rules, 2025 cap the period for answering grievances at 90 days. This is general information, not legal advice.
01
Rights and where they come from
Right
Section
What a person can ask for
Information about processing
11
A summary of the personal data processed and the processing activities, and the identities of other fiduciaries and processors it was shared with.
Correction and erasure
12
Correction, completion or updating of data, and erasure unless it is needed for the specified purpose or by law.
Grievance redressal
13
A readily available way to complain to the fiduciary or consent manager, used before approaching the Board.
Nomination
14
Name another person to exercise these rights after death or incapacity.
Withdrawal of consent
6(4)
Withdraw consent as easily as it was given.
02
Duties of a data principal
Comply with applicable laws while exercising rights under the Act.
Do not impersonate another person when providing personal data.
Do not suppress material information when providing data for a document, identifier or proof issued by the State.
Do not register a false or frivolous grievance or complaint with a fiduciary or the Board.
Give only verifiably authentic information when asking for correction or erasure.
Breach of these duties can attract a penalty of up to ₹10,000 under item 5 of the Schedule.
03
What it means for an office using AI
Every person whose data goes into an AI tool remains a data principal, whether the tool is a cloud chatbot or a server in your building. If a client asks under section 11(1)(b) who their data was shared with, the answer should name any AI vendor that processed it as a data processor. That is much easier when the office records which tool processed whose data.
Rule 14 asks fiduciaries to publish how people can make requests and the period, not exceeding 90 days, within which grievances are answered. On ANVE, documents and the log of model calls stay on the device in the office, so the office can see which named user asked what. Deciding what to tell the data principal remains the office’s job.
04
When the rights apply
Rule 14, on exercising these rights, comes into force eighteen months after the DPDP Rules, 2025 were published in the Gazette dated 13 November 2025 (rule 1(4)). Section 17 takes some processing out of these rights, for example processing by courts in judicial functions or for preventing and investigating offences.
This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
05
Questions people ask
Is an employee a data principal?
Yes. Employees are individuals whose data the employer processes. Section 7(i) lets an employer process their data for employment purposes without consent, but the other duties of a fiduciary still apply.
Can a client ask us to delete their file?
Yes, under section 12(3), but you may keep data if it is needed for the specified purpose or a law requires you to retain it, such as record-keeping rules for your profession.
Does the DPDP Act give a right to data portability?
No. The rights are in sections 11 to 14: information, correction and erasure, grievance redressal and nomination. There is no general right to move data to another provider, unlike Article 20 of the EU GDPR.
Who acts for a child?
The parent or lawful guardian, who is included in the definition of data principal in section 2(j). Section 9 requires verifiable parental consent before a child’s data is processed.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
