Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsRole
A Data Principal is the individual whose personal data is processed, and the holder of the rights the Act grants.
TL;DR
A Data Principal (Section 2(j)) is the individual whose personal data is processed and the holder of the rights the Act grants, including access, correction, erasure, grievance redressal and nomination. For a child, it includes the parent or lawful guardian.
"Data Principal" means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf.
If the data is about you, you are the Data Principal. The Act gives you rights to access, correct and erase your data, to grievance redressal, and to nominate someone to act for you.
For a child, the Data Principal includes the parent or lawful guardian. For a person with disability who has a lawful guardian, it includes that guardian acting on their behalf.
When you open an account with an online store, you are the Data Principal. The store is the Data Fiduciary.
Can a company be a Data Principal?
No. The Act protects natural persons. A company's own information is not a Data Principal's personal data.
What rights does a Data Principal have?
Access, correction and erasure, grievance redressal, and nomination (Sections 11 to 14).
Consultant-led and partner-backed.