A Data Principal has four rights in Chapter III of the DPDP Act: to access information about her data (Sec. 11), to have it corrected, completed, updated or erased (Sec. 12), to a grievance mechanism (Sec. 13), and to nominate someone to act for her (Sec. 14). Alongside them sits the right to withdraw consent under Sec. 6(4). Sec. 15 then lists five duties she owes in return.
This page covers each right, the detail Rule 14 adds, and what a Data Fiduciary has to have in place. The substantive duties commence on 13 May 2027 under Rule 1(4), the same date as notice and consent. For the roles named here, see DPDP Act definitions.
Right to access information, Sec. 11
Under Sec. 11(1), on a request made in the prescribed manner, the Data Principal can obtain from the Fiduciary to whom she has previously given consent:
- a summary of the personal data being processed and of the processing activities carried out on it;
- the identities of all other Data Fiduciaries and Data Processors with whom the data has been shared, with a description of what was shared; and
- any other information related to her data and its processing that may be prescribed.
Note what the Act does not promise: a copy of the data. It promises a summary of the data and the processing, plus the identities of recipients. If you design the response around a full export, you are offering more than Sec. 11 requires.
Sec. 11(2) withholds the sharing information in one case. Where the Fiduciary shared data with another Data Fiduciary authorised by law to obtain it, on a written request, for preventing, detecting or investigating offences or cyber incidents, or prosecuting or punishing offences, clauses (b) and (c) do not apply. That is a narrow carve-out, not a general confidentiality shield.
The right runs against a Fiduciary to whom she has previously given consent, including consent referred to in Sec. 7(a). Rule 14(2) mirrors that: she makes the request to the Fiduciary to whom she has previously given consent, using the means and particulars it requires.
Right to correction, completion, updating and erasure, Sec. 12
Sec. 12(1) gives the right to correction, completion, updating and erasure of personal data processed on consent, in accordance with any requirement or procedure under any law for the time being in force.
On a correction, completion or updating request, Sec. 12(2) requires the Fiduciary to correct inaccurate or misleading data, complete incomplete data, and update the data. On an erasure request, Sec. 12(3) requires it to erase unless retention is necessary for the specified purpose or for compliance with law.
Erasure interacts with two other rules:
- Sec. 8(7) requires erasure on withdrawal of consent, or once it is reasonable to assume the purpose is no longer served, and requires the Fiduciary to cause its Processors to erase too.
- Rule 8(3) requires a Fiduciary to retain personal data, associated traffic data and logs of processing for a minimum of one year for the purposes in the Seventh Schedule, after which it must cause them to be erased unless another law requires further retention.
The Act's own illustration shows the first limit: a bank that must keep identity records for ten years after closing an account keeps them, despite an erasure request, because retention is necessary for compliance with law.
Right to grievance redressal, Sec. 13, and the ninety days
Sec. 13(1) gives the right to readily available means of grievance redressal from a Data Fiduciary or Consent Manager for any act or omission regarding its obligations or the exercise of her rights. Sec. 8(10) separately obliges the Fiduciary to establish an effective mechanism.
Sec. 13(2) leaves the response period to the Rules, and Rule 14(3) fills it: every Data Fiduciary and Consent Manager must prominently publish its grievance redressal system on its website or app, with a response within a reasonable period not exceeding ninety days, and implement appropriate technical and organisational measures to meet that period.
"Not exceeding ninety days" is a ceiling, not a target. Whether a shorter period is reasonable depends on the request, and the Act does not say.
Sec. 13(3) requires the Data Principal to exhaust this route before approaching the Board. A poorly run grievance process therefore does two things: it is a compliance gap in itself, and it decides which complaints reach the regulator.
Right to nominate, Sec. 14
Sec. 14(1) lets a Data Principal nominate any other individual to exercise her rights if she dies or becomes incapable. Sec. 14(2) defines incapacity as inability to exercise her rights due to unsoundness of mind or infirmity of body.
Rule 14(4) lets her nominate one or more individuals, in accordance with the Fiduciary's terms of service and applicable law, using the means and particulars the Fiduciary requires. In practice that means the nomination form needs to exist, and the Fiduciary needs a way to verify a nominee's claim later.
What a Data Fiduciary has to publish
Rule 14(1) requires the Fiduciary and, where applicable, the Consent Manager, to prominently publish on its website or app:
- the details of the means by which a Data Principal can make a request to exercise her rights; and
- the particulars, such as a username or other identifier, that may be required to identify her under its terms of service.
Rule 14(5) defines "identifier" as any sequence of characters issued by the Fiduciary to identify the Data Principal, such as a customer ID, application reference number, enrolment ID, email address, mobile number or licence number.
Rule 9 adds that the Fiduciary must prominently publish business contact information for its Data Protection Officer, if applicable, or another person who can answer questions about the processing, and mention it in every response to a rights communication. Sec. 6(3) requires the same contact details with each consent request.
The duties Data Principals owe, Sec. 15
Sec. 15 lists five duties:
- comply with all applicable laws while exercising rights under the Act;
- not impersonate another person when providing personal data for a specified purpose;
- not suppress material information when providing personal data for a document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities;
- not register a false or frivolous grievance or complaint with a Fiduciary or the Board; and
- furnish only verifiably authentic information when exercising the right to correction or erasure.
Sec. 8(1) is explicit that the Fiduciary stays responsible for compliance "irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties". So a Data Principal's breach of Sec. 15 does not excuse your own failure. The Schedule sets the penalty for breaching Sec. 15 at up to ten thousand rupees.
Building the response process
The four rights share one operational shape: intake with identity checks, routing, a clock, a decision with a reason, and a record. A workable minimum is a published request channel, a queue that tracks the ninety-day ceiling for grievances, and a way to reach every Processor holding the data when an erasure or correction is accepted.
For the product view, see rights and grievance handling, and the processing register for finding where a person's data sits. Consent and withdrawal are in DPDP consent requirements. Penalty ceilings and how the Board sets them are in DPDP penalties explained, and the compliance map lists each provision against its control.