The DPDP Act 2023 gives every individual whose data is processed, called a Data Principal, a set of rights. Data Fiduciaries must be able to honour them through a published process, and an auditor will test that the process actually works.
The rights of a Data Principal
| Right | What it means | Act |
|---|---|---|
| Access to information | A summary of the personal data processed, the processing activities, and the identities of other Fiduciaries and Processors it has been shared with | Section 11 |
| Correction and completion | Correct inaccurate data and complete incomplete data | Section 12 |
| Erasure | Erasure of personal data that is no longer needed for its purpose or legally required retention | Section 12 |
| Grievance redressal | A readily available way to raise a grievance, before approaching the Board | Section 13 |
| Nomination | Nominate another person to exercise these rights on death or incapacity | Section 14 |
| Withdraw consent | Withdraw at any time, as easily as it was given | Section 6 |
What Data Fiduciaries must put in place
- A published channel to make requests, with the means of identifying the requester
- An internal log that tracks every request from receipt to closure
- Timelines that meet the periods set by the Rules
- A way to propagate corrections and erasure to Data Processors
- Published contact details of the person who can answer data protection questions
- A grievance redressal mechanism with an escalation route
Where requests usually fail
- Data is spread over CRM, core systems, spreadsheets and email, so no one can find it all
- Erasure is done in the main system but not in backups, analytics and vendor systems
- Withdrawal stops emails but not SMS, WhatsApp or retargeting
- Requests arrive in generic inboxes and are never logged
- No process to verify the identity of the requester
Duties of a Data Principal
The Act also places duties on individuals: comply with applicable laws, do not impersonate another person, do not suppress material information when providing data for official documents, do not file false or frivolous grievances, and furnish only verifiable and authentic information when exercising rights. Breach of these duties can attract a penalty of up to ₹10,000.
Test your request process against the DPDP audit checklist, and see DPDP Rules 2025 explained for timelines.