Your rights under the DPDP Act: access, correction, erasure, grievance and nomination

The DPDP Act gives every individual, the Data Principal, a set of rights over their personal data. If you run a business, these are the requests you’ll need to answer. If you’re a customer, this is what you can ask for.

1. Right to information (section 11)

You can ask a Data Fiduciary that processes your data with your consent, or under the “voluntarily provided” legitimate use, for:

• a summary of your personal data being processed and the processing activities,
• the identities of all other Data Fiduciaries and Data Processors it has shared your data with, with a description of what was shared, and
• any other information the Rules prescribe.

There’s an exception for sharing with authorities for preventing, detecting or investigating offences.

2. Right to correction and erasure (section 12)

You can ask the fiduciary to:

• correct inaccurate or misleading data,
• complete incomplete data,
• update it, and
• erase data that’s no longer needed for the purpose, unless a law requires it to be kept.

3. Right to grievance redressal (section 13)

Every fiduciary must have readily available means to handle grievances. The DPDP Rules require a response within a period that may not exceed 90 days. You must use the fiduciary’s grievance route before complaining to the Data Protection Board.

4. Right to nominate (section 14)

You can nominate another person to exercise your rights if you die or become incapable through unsoundness of mind or infirmity of body.

How to exercise your rights

Rule 14 requires every fiduciary to publish on its website or app how to make a request, and the details (such as a username or account ID) needed to identify you. Many will offer an online form or an option in your account settings.

What businesses should build

• A request form or account page, linked from the privacy notice.
• Identity checks that are proportionate. Don’t ask for Aadhaar to answer a newsletter erasure request.
• A tracker with deadlines, so no request is lost.
• Templates for common answers.
• A way to pass erasure requests to processors, who must delete too.
• Records of each request and reply.

The limits

• Rights under section 11 apply to processing based on consent or voluntarily provided data. They may not apply in the same way to other legitimate uses.
• Erasure gives way to legal retention duties, such as tax records.
• Exemptions under section 17 (for example investigation of offences) can limit rights.

Go deeper

Our courses include a rights-request simulation for teams. Browse the courses.

This article is for education and is not legal advice.