A Data Principal is the individual the personal data is about. In HR terms, that means every employee, ex-employee, intern, contract worker and job applicant whose details sit in your employee master data, ATS or attendance system. Under section 2(j) of the DPDP Act, it also includes the parent or lawful guardian of a child, and the lawful guardian of a person with disability acting on their behalf.

Rights an employee will be able to exercise

Sections 11 to 14 give the Data Principal four rights, none of which can be enforced before 13 May 2027:

• Access (s.11): a summary of the personal data being processed, the processing done, and who else it was shared with, such as your payroll processor or insurer.
• Correction and erasure (s.12): fix wrong data, complete or update it, and ask for erasure unless you still need it for the purpose or another law requires you to keep it.
• Grievance redressal (s.13): complain to the employer first; only after that route is exhausted can the person go to the Data Protection Board. The Rules require you to publish a response period of no more than 90 days.
• Nomination (s.14): name someone to exercise these rights after death or incapacity.

There is a catch employers should understand. The access and correction rights in sections 11 and 12 attach to data processed on consent, including data voluntarily provided under section 7(a). Where you process salary or attendance data under the employment ground in section 7(i), the statutory access right may not apply in the same way. Lawyers are still reading this differently, so plan to answer such requests anyway, through your employee self-service portal where possible.

Duties on the employee’s side

Section 15 is unusual: it puts duties on the individual. A Data Principal must not impersonate someone else, must not suppress material information when giving data for an identity or address document, must not file false or frivolous complaints, and must give only verifiably authentic information when seeking a correction. The penalty for breaching these duties is up to Rs 10,000. For HR, the practical case is a candidate submitting someone else’s degree certificate during background verification.

Frequently asked questions

Is a rejected candidate still a Data Principal?

Yes. Anyone whose CV, phone number or interview notes you hold is one, which is why old applicant data in your applicant tracking system belongs in your retention schedule.

Can an ex-employee ask us to delete everything?

They can ask, but erasure gives way where the law requires you to keep records, such as wage registers or tax data, so delete only what has no legal or live purpose and tell the person what you are keeping and why.

How fast must we answer an employee’s request?

The Rules set an outer limit of 90 days for responding to grievances, but a slow reply invites a complaint to the Board, so route requests through your existing grievance redressal desk with a much shorter internal target.

The organisation on the other end of these rights is the Data Fiduciary, and that page explains where your payroll vendor fits.