Data Principal meaning: the patient's rights under DPDP Who the Data Principal is in a clinic, what sections 11 to 14 give them, and who speaks for a child.

A Data Principal, under section 2(j) of the Digital Personal Data Protection Act, 2023, is "the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf". In a clinic, the Data Principal is the patient. For a child patient it is the child and the parent or guardian. The clinic, which decides why and how the data is processed, is the Data Fiduciary; its software vendor is a Data Processor.

What rights does a Data Principal have?

Chapter III of the Act gives four, in sections 11 to 14. Each applies to data the person gave consent for (or data processed under section 7(a), where they volunteered it for a specified purpose).

1. Right to access information (s.11): on request, "a summary of personal data which is being processed" and "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared".
2. Right to correction and erasure (s.12): the Data Fiduciary shall "correct the inaccurate or misleading personal data", complete it and update it; on an erasure request it "shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force".
3. Right of grievance redressal (s.13): "readily available means of grievance redressal" from the Data Fiduciary or Consent Manager, with a response within a period to be prescribed. Section 13(3) says the person "shall exhaust the opportunity of redressing her grievance under this section before approaching the Board".
4. Right to nominate (s.14): to name another individual who, "in the event of death or incapacity of the Data Principal", exercises these rights.

The erasure right has a limit that matters to doctors: records a law requires the clinic to keep are not erased on request. NMC regulation 1.3 on medical records is such a law; see medical record.

Does a Data Principal have duties too?

Yes. Section 15 lists them, including "not to impersonate another person while providing her personal data", "not to register a false or frivolous grievance or complaint" and "to furnish only such information as is verifiably authentic" when seeking correction or erasure. The Schedule sets a penalty for breach of these duties that "may extend to ten thousand rupees".

Who is the Data Principal for a child patient?

The child, and the parent or lawful guardian with them. Section 2(f) defines a child as "an individual who has not completed the age of eighteen years". Section 9(1) adds a duty on the clinic: before processing a child's personal data it must "obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed". Section 9(3) bars "tracking or behavioural monitoring of children or targeted advertising directed at children". The Schedule lists breach of section 9 at up to two hundred crore rupees.

What does this mean at a small OPD desk?

A paediatric clinic registers a 7-year-old. The parent at the counter is the person who gives consent and who can later ask what data the clinic holds, ask for a wrong mobile number to be corrected, or raise a grievance. When the clinic's data-protection obligations commence, the registration slip needs a consent line the parent signs, and the clinic needs one named person who answers data questions. The erasure request a parent might make for an old file is answered by the retention rule: records the council requires the clinic to keep stay. When these sections come into force is covered in our DPDP Act guide for clinics.