What is a data principal?
A data principal is the Digital Personal Data Protection Act's term for the individual to whom personal data relates (section 2(j)) — the GDPR calls the same person a "data subject". When the individual is a child (anyone under 18), the term includes their parents or lawful guardian; for a person with a disability, it includes the lawful guardian acting for them. On WhatsApp, every customer whose phone number, profile name, messages, voice notes, media or order details a business holds is a data principal of that business.
Chapter III of the Act gives data principals four groups of rights against the data fiduciary. They can ask for a summary of the personal data being processed and the processing activities, and the identities of other fiduciaries and processors it was shared with (section 11). They can ask for it to be corrected, completed, updated or erased, unless keeping it is necessary for the purpose or required by law (section 12). They can use a readily available grievance channel (section 13), and they can nominate another person to exercise these rights if they die or lose capacity (section 14). Separately, they can withdraw consent at any time, as easily as they gave it (section 6(4)).
The DPDP Rules 2025, which bring these rights into operation with most of the Act's duties by 2027, make them practical: the business must publish how to make a request and what identifier it needs — for a WhatsApp customer, usually the phone number — and must resolve grievances within a period it publishes of no more than 90 days. A principal has to use that channel before taking a complaint to the Data Protection Board. Principals carry duties too (section 15): they must not impersonate someone, suppress material information or file false or frivolous complaints. The obligations on the business side are covered under Data Fiduciary.
Key takeaways
- A data principal is the individual the personal data is about — every customer whose number, name or chats a WhatsApp business holds.
- For a child under 18 the data principal includes the parent or lawful guardian, and for a person with a disability, their lawful guardian.
- The DPDP Act gives rights to information, correction and erasure, grievance redressal and nomination, plus withdrawal of consent at any time.
- A principal must use the business's grievance channel before complaining to the Data Protection Board; the Rules allow up to 90 days to respond.
- Principals have duties too: no impersonation and no false or frivolous complaints, with a penalty of up to 10,000 rupees.
Handle a customer's DPDP request, step by step
9/9
ticked
- Required
- 4 / 4
- Optional
- 5 / 5
Request handled the DPDP way
Every item ticked.
Request handled the DPDP way. 9 of 9 ticked.
How does a data principal work?
Recognise the request
A customer does not need to mention the Act. "Remove my details" is an erasure request, "what do you know about me" an information request, "stop the offers" a withdrawal of consent for marketing.
Confirm it is the same person
A request from the WhatsApp number on file already matches the identifier you hold. Ask for extra proof only when the request comes from elsewhere or concerns someone else's data.
Log it with a deadline
Record the request, its type and the date received, and track it against your published response time, which the DPDP Rules cap at 90 days for grievances.
Act across every system
Apply the change in the CRM, the BSP's contact store and inbox, campaign audiences, chatbot memory, exports and backups on their next cycle — and add withdrawals to the suppression list first.
Reply and explain what remains
Confirm what you did. If the law requires you to keep some data — invoices for tax, for example — say what you kept, why and for how long.
Example: Three requests on one Pune support number
On a Tuesday a Pune electronics retailer's WhatsApp support line receives three messages. Rohan asks what data the shop holds about him; the agent sends a summary of his contact details, purchase history and the delivery partner his address was shared with. Sneha writes "delete my account"; the shop erases her profile and chat history from the CRM and BSP inbox, keeps her invoices because tax law requires them, and tells her so. Finally, a father writes on behalf of his 15-year-old son, Imran, who signed up for offers without permission; for a child, the parent counts as the data principal, so the shop removes the marketing consent and suppresses the number.
Key facts at a glance
A data principal: key facts and limits
- Defined in
- DPDP Act section 2(j)
- GDPR equivalent
- Data subject
- Rights (sections 11–14)
- Information, correction and erasure, grievance redressal, nomination
- Withdraw consent
- Any time, as easily as given (s. 6(4))
- Children
- Under 18 — parent or lawful guardian acts
- Grievance response
- Published period of up to 90 days
- Before the Board
- Grievance channel must be used first (s. 13(3))
- Principal's duty penalty
- Up to 10,000 rupees (s. 15)
Why does a data principal matter?
Requests arrive where customers already are — often as a plain WhatsApp message to your support number: "why do you have my number?", "delete everything", "stop the offers but keep my order updates". Agents who recognise these as rights requests, verify the person simply and route the work to every system that holds the data turn a potential complaint to the Board into a resolved ticket. Agents who treat them as ordinary chats leave data in the CRM, the BSP inbox and last month's export.
Common wrong turns
Common mistakes with a data principal
Waiting for the legal words
Customers rarely say "under section 12". Train agents on everyday phrasings of each right and give them a tag for rights requests in the inbox.
Erasing in one system only
Deleting a CRM record while the BSP inbox, campaign lists and exports keep the data is not erasure. Keep a map of where WhatsApp data lives and work through it every time.
Demanding heavy proof of identity
Asking for ID documents to delete a WhatsApp chat collects more data than the request needs. Matching the number is often enough; escalate only when something does not add up.
Forgetting that a parent can act
For a child, the parent or lawful guardian is the data principal. Accept their requests, and check age signals before marketing to anyone who may be under 18.
Good practice
Best practices for a data principal
- Publish one clear route for requests — a WhatsApp keyword, an email address or a form — and list it in every privacy notice.
- Prepare reply templates for each right so agents answer consistently.
- Report request volumes and response times monthly; a spike usually points at a campaign problem.