A data principal, in India’s Digital Personal Data Protection Act, 2023, is the individual to whom personal data relates. For an email list, every subscriber is a data principal. Where the individual is a child (under 18 under the Act) or a person with a disability who has a lawful guardian, the term includes the parent or guardian acting for them.
Data principals have rights the business must respect. They can ask for a summary of the personal data being processed and the processing activities, request correction, completion, updating or erasure of their data, use a grievance redressal mechanism the business must provide, and nominate someone to exercise their rights if they die or become incapable. They can also withdraw consent at any time.
The Act also places duties on data principals. They must not impersonate someone else, must not suppress material information when providing data, and must not file false or frivolous complaints. These duties exist alongside their rights and carry their own penalty, although it is small compared with the penalties for businesses.
For children, the Act is stricter. A data fiduciary must obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data, and must not track, behaviourally monitor or target advertising at children, subject to exemptions the government may notify. A brand whose audience includes school students should think carefully before running email marketing to them.
A subscriber in Nagpur writes to a home-décor brand asking what data it holds about her. The brand looks up her contact record, exports her details, list memberships and consent history, and sends her a summary within its stated response time.
MailNesto has a public preference centre where subscribers can update details, choose topics, pause emails and download a copy of their data, and a data-requests log for handling access and erasure requests.