The four Data Principal rights
Access, correction and erasure, grievance, nomination. Four statutory rights that every Data Fiduciary must be able to service. Rule 14 gives you seven days to respond to a valid request, and ninety days to complete an erasure or a grievance.
01Four rights, and which section each one lives in
Right to access
A summary of the personal data being processed and the processing activities. Identities of other Data Fiduciaries and Processors with whom the personal data has been shared.
Right to correction and erasure
Correct inaccurate or misleading personal data. Complete incomplete data. Erase personal data no longer needed for the specified purpose or where consent is withdrawn.
Right to grievance redressal
Complain to the Data Fiduciary or a Consent Manager. If unresolved, escalate to the Data Protection Board.
Right to nominate
Nominate a person to exercise the Data Principal's rights on death or incapacity.
02Sec. 11: the right to access
The Data Principal can ask for a summary of what personal data you hold about them, and what you are doing with it. You must respond.
The summary must include the personal data being processed and the processing activities undertaken. It must also identify all other Data Fiduciaries and Data Processors with whom the personal data has been shared, along with a description of the personal data shared. This is a downstream-transparency obligation.
Personal data collected under Section 7 legitimate uses (medical emergency, court orders, employment) may be excluded from the summary, at your discretion, if disclosure would compromise the purpose.
03Sec. 12: correction and erasure
Correction, completion and updating are three distinct rights. Erasure is a fourth.
Under Sec. 12(1), the Data Principal can ask you to (a) correct inaccurate or misleading personal data, (b) complete incomplete personal data, and (c) update outdated personal data. You must act unless another law prevents you.
Under Sec. 12(3), the Data Principal can ask you to erase their personal data. You must erase unless retention is necessary for the specified purpose or for compliance with any Indian law. The erasure right sits alongside Section 8(7), which requires proactive erasure whenever purpose is exhausted or consent is withdrawn.
04Sec. 13: grievance redressal
The Data Fiduciary is the first stop. The Board is the second.
Section 13 requires you to establish a readily available grievance redressal mechanism. Rule 14 gives you ninety days from receiving a valid complaint to resolve it. If the Data Principal is dissatisfied or you do not respond, they can escalate to the Data Protection Board under Section 27.
The mechanism must be free of cost to the Data Principal. It must accept complaints in any of the 22 Eighth Schedule languages, per Rule 3's language obligation. Published contact information for the DPO or an authorised person, under Sec. 8(9), is a Rule 14 pre-requisite.
05Sec. 14: nomination
Every Data Principal may nominate another individual to exercise their rights in the event of death or incapacity.
Section 14 is unique to DPDP. It is not present in GDPR, CCPA or LGPD in the same form. The nominee steps into the Data Principal's shoes for the purposes of Sections 11, 12 and 13. The nominee cannot expand the rights or give fresh consent on behalf of the original Data Principal for new processing.
For a Data Fiduciary, this means your Data Principal record must be able to hold a nominee attribute, and your DSR handler must accept a nomination proof (typically a will, a nomination form, or a court order) before servicing a nominee request.
06Rule 14: response timelines
| Trigger | Timeline | Basis |
|---|---|---|
| Acknowledge a valid Data Principal request | Within 7 days of receipt. | Rule 14 |
| Complete an access or correction request | Reasonable time, based on request scope; the Rule is expected to prescribe 30 days as the outer limit. | Rule 14 |
| Complete an erasure request | Within 90 days of receipt, unless retention required by law. | Rule 14 |
| Resolve a grievance | Within 90 days of the complaint. | Rule 14 |
| Escalation to the Board | After Data Fiduciary's 90-day window closes, or immediately if grievance mechanism is absent. | Sec. 27 |
07Sec. 15: Data Principal duties
The Act does not give one-way rights. Section 15 puts four duties on the Data Principal.
- Comply with all applicable laws while exercising rights.
- Not impersonate another person while providing personal data.
- Not suppress any material information while providing personal data.
- Not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board.
Breach of a Sec. 15 duty attracts a penalty of up to Rs. 10,000 under the Schedule. The Board's expected approach is to warn first and penalise only for repeat abuse. This clause is designed to protect Data Fiduciaries from bad-faith complaint floods once Rules 14 and Sec. 27 become live enforcement paths.