What rights do people have under the DPDP Act?
People have the right to know what data an organisation holds about them, to correct or erase it, to complain, and to nominate someone to act for them. The DPDP Act calls these people Data Principals and sets their rights in Sections 11 to 14. The Rules cap the time to resolve a grievance at 90 days.
What are the Data Principal rights, section by section?
The DPDP Act gives every Data Principal four rights, plus the right to withdraw consent:
| Right | Section | What the person can ask for |
|---|---|---|
| Access to information | Section 11 | A summary of their personal data and how it is processed, and who it was shared with |
| Correction and erasure | Section 12 | Correction, completion, updating and erasure of their personal data |
| Grievance redressal | Section 13 | A response to a complaint from the Data Fiduciary or Consent Manager |
| Nomination | Section 14 | Another person to exercise their rights after death or incapacity |
| Withdrawal of consent | Section 6 | To withdraw consent as easily as it was given, stopping processing for that purpose |
What does the right to access information include?
The right to access lets a person get a summary of the personal data a Data Fiduciary holds about them and the processing it carries out. It also covers the identities of the other Data Fiduciaries and Data Processors the data was shared with, and a description of what was shared.
When must a company erase personal data on request?
A company must erase personal data on request unless keeping it is needed for the specified purpose or to comply with a law. Erasure also follows from Section 8(7): once the purpose is served or consent is withdrawn, the data should go, subject to the retention periods in the Rules.
How fast must a Data Fiduciary respond?
The DPDP Rules 2025 require each Data Fiduciary, under Rule 14, to publish on its website or app how to make a request, what details it needs to identify the person, and the period for answering grievances, which cannot exceed 90 days. A person must first use the Data Fiduciary's grievance process before going to the Data Protection Board. These duties apply from 13 May 2027.
What duties do Data Principals have?
Section 15 sets duties for Data Principals, and breaking them can lead to a penalty of up to ₹10,000. A Data Principal must:
- comply with the provisions of applicable laws when exercising their rights;
- not impersonate another person when providing personal data;
- not suppress material information when providing personal data for an official identity document or proof of identity or address;
- not register a false or frivolous grievance or complaint;
- give only verifiably authentic information when asking for correction or erasure.
How should you handle rights requests?
- Publish a simple way to make a request, and the identifiers you need.
- Verify who is asking before you share or change any data.
- Know where the person's data lives, including in vendor systems and exports.
- Log each request with a due date and the outcome, keeping grievances within the 90-day limit.
- Keep a record of what you sent, corrected or erased.
For children, the parent or lawful guardian exercises these rights. See children's data under the DPDP Act.
How GRC Flow helps
GRC Flow keeps a register of Data Principal requests, each with its response clock, an owner and the outcome, as part of its DPDP registers. Its personal data discovery helps you find where a person's data sits in your exports before you answer.
Frequently asked questions
What are the rights of a Data Principal under the DPDP Act?
The right to access a summary of their personal data and how it is processed (Section 11), to correction, completion, updating and erasure (Section 12), to grievance redressal (Section 13), and to nominate another person to act for them after death or incapacity (Section 14).
How long does a company have to respond to a DPDP rights request?
The DPDP Rules 2025 set no single deadline for every request, but a grievance must be answered within the period the Data Fiduciary publishes, which cannot exceed 90 days (Rule 14). Answering sooner is good practice, and the Data Fiduciary should track each request against its due date.
Is there a right to erasure under the DPDP Act?
Yes. Section 12 lets a Data Principal ask for their personal data to be erased, and the Data Fiduciary must erase it unless keeping it is needed for the specified purpose or to comply with a law.
What are the duties of a Data Principal under the DPDP Act?
Section 15 requires Data Principals to follow applicable laws, not impersonate another person, not suppress material information when providing personal data for official identity documents, not file false or frivolous grievances or complaints, and give only verifiably authentic information when asking for correction or erasure. Breach can lead to a penalty of up to ₹10,000.
Can a Data Principal complain directly to the Data Protection Board?
A Data Principal must first use the Data Fiduciary's grievance redressal process. Only after exhausting it can they complain to the Data Protection Board.
Sources
- PIB: Digital Personal Data Protection Rules, 2025
- Deloitte India: Point of view on the DPDP Act
- AMLEGALS: Penalties under the DPDP Act, 2023
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.