Data Principal

DPDP Act 2023 — Section 2(j)

Under the DPDP Act 2023, a Data Principal is the individual to whom the personal data relates. In the context of banking and debt recovery, the borrower, guarantor, or any individual whose data is collected and processed is the Data Principal. Data Principals have rights under the DPDP Act including the right to access information about processing, the right to correction and erasure, the right to nominate another person to exercise rights after death or incapacity, and the right to file a complaint with the Data Protection Board. For children (under 18), the parent or lawful guardian is treated as the Data Principal.

A borrower whose loan application, CIBIL score, and income tax return are processed by an NBFC is the Data Principal.

In banking and recovery work, the Data Principal under Section 2(j) of the DPDP Act 2023 is usually the borrower or guarantor whose financial and identity data the lender holds. The status matters because it carries enforceable rights — to know how data is processed, to seek correction or erasure, to nominate someone to act after death or incapacity, and to complain to the Data Protection Board. A borrower in a contested recovery may invoke these rights tactically, for instance seeking correction of a disputed entry that feeds a credit record. Counsel for the lender must be ready to honour legitimate requests while distinguishing them from attempts to obstruct lawful processing required for the loan or for statutory compliance. Where the individual is a child, the parent or guardian stands in as Data Principal, which changes consent handling. Getting a Data Principal's request wrong — ignoring or mishandling it — invites a complaint. Well-advised lenders log and respond to such requests on record.