Duties of Data Principals: yes, individuals have obligations under the DPDP Act too

Most data protection laws only regulate organisations. India’s DPDP Act is different. Section 15 lists duties that every Data Principal, every individual, must follow when exercising their rights. Break them and the Data Protection Board can impose a penalty of up to ₹10,000.

The five duties

A Data Principal must:

1. Comply with all applicable laws while exercising rights under the Act.
2. Not impersonate another person while providing personal data for a specified purpose.
3. Not suppress material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State.
4. Not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board.
5. Furnish only verifiably authentic information when exercising the right to correction or erasure.

Why the law includes them

The drafters had real problems in mind:

• Frivolous complaints could overwhelm a small Board and be used to harass businesses.
• Impersonation to access or erase someone else’s data is a fraud risk.
• False correction requests could be used to clean up records dishonestly, for example to change a date of birth on official records.

What this means in practice

For individuals

• Use the business’s grievance route first, and keep your complaint factual.
• Don’t submit a complaint you know to be untrue.
• When you ask for a correction, be ready to show proof.
• Never use another person’s identity to access or change their data. That’s also likely an offence under other laws.

For businesses

• Verify identity before acting on access, correction or erasure requests. Section 15 supports reasonable checks.
• Ask for evidence when a correction changes something significant, such as name, date of birth or address.
• Record suspicious or repeated requests. If a request appears false or frivolous, document why, but still respond properly. Only the Board can impose the penalty.

Criticism

Some commentators worry that the duties, and the threat of a penalty, could discourage genuine complaints, particularly from people who aren’t confident with legal language. The Board will need to apply them carefully, saving penalties for clear abuse.

The Board’s power

Section 28 lets the Board issue a warning or impose costs if it finds a complaint false or frivolous, alongside the penalty in the Schedule.

Go deeper

Our courses cover the rights and duties of Data Principals in depth. Browse the courses.

This article is for education and is not legal advice.