Sections 11 to 14
Rights of the data principal under DPDP
The Act gives individuals four rights against a Data Fiduciary and sets some duties of their own. Rule 14 sets how those rights are exercised.
Short answer
Under the DPDP Act, a Data Principal has the right to access information about their personal data (s.11), to correction, completion, updating and erasure (s.12), to grievance redressal (s.13) and to nominate someone to act for them on death or incapacity (s.14). Rule 14 requires fiduciaries to publish how to make requests, and Rule 14(3) caps the published grievance response period at 90 days. A Data Principal must use the fiduciary's grievance redressal before approaching the Board (s.13(3)).
The four rights at a glance
| Right | Section | What the person can ask for |
|---|---|---|
| Access to information | s.11 | A summary of their personal data and its processing, and the identities of other Data Fiduciaries and Data Processors it was shared with |
| Correction and erasure | s.12 | Correction, completion, updating and erasure of their personal data |
| Grievance redressal | s.13 | A response to a grievance from the Data Fiduciary or Consent Manager, before going to the Board |
| Nomination | s.14 | Naming another person to exercise their rights on death or incapacity |
An access response under s.11 has two parts: the summary of personal data and processing, and the identities of the other fiduciaries and processors the data was shared with. Plan to answer both.
Withdrawing consent (s.6(4)) works alongside these rights: it can be done at any time, as easily as consent was given. Data Principals also have duties of their own under s.15.
Erasure in practice
A Data Principal can ask for erasure under s.12. Separately, a fiduciary must erase personal data on its own when consent is withdrawn or the purpose is no longer served, and make its processors erase it, unless a law requires retention (s.8(7)).
For the e-commerce, social media and online gaming classes listed in the Third Schedule, Rule 8 sets a timeline: erasure three years after the Data Principal last approached the fiduciary or exercised their rights (or from commencement, whichever is later), with at least 48 hours' notice before erasure.
Where a law requires you to keep the data, record which requirement applies and tell the person why the data was kept.
Grievances come before the Board
Every Data Fiduciary must run effective grievance redressal (s.8(10)). Under Rule 14(3), each Data Fiduciary and Consent Manager publishes its period for responding to grievances, which must not exceed 90 days, and puts measures in place to keep to it.
A Data Principal must exhaust that grievance route before approaching the Board (s.13(3)). Under Rule 9, every response to a Data Principal must mention the contact of the person who can answer questions about processing.
Nomination (s.14)
A Data Principal can nominate another person to exercise their rights in the event of their death or incapacity (s.14). Rule 14 also covers nomination, so your request process should accept and record nominations alongside access, correction and erasure.
Making rights work under Rule 14
- 01Publish the route
Publish on your website or app how Data Principals make requests and which identifier they need to give (Rule 14).
- 02Verify identity
Check the requester against the published identifier before starting work.
- 03Find the data
Search every system that holds the person's data, including those run by processors.
- 04Respond and record
Reply with the outcome and your contact person (Rule 9), and keep a record of what you did.
- 05Handle grievances
If the person is not satisfied, treat it as a grievance and answer within your published period, which cannot exceed 90 days.
The 90-day figure in Rule 14(3) is the cap on the grievance response period. Publish your own response period for rights work too, and aim to finish well inside 90 days; see Rule 14 requests and the 90-day handling guide.
How TruePrivacy helps
The privacy center gives Data Principals a branded portal to submit requests, manage preferences, check status and download their data through a secure link. Data Principal requests cover access, correction, erasure, consent withdrawal and nomination, with identity verification before work starts and tasks fanned out to connected systems.
Deadlines are tracked per law against the DPDP 90-day outer limit, and the grievance desk adds categories, SLA states and escalation. Every step lands in the audit trail.
What rights do individuals have under the DPDP Act?
Access to information (s.11); correction, completion, updating and erasure (s.12); grievance redressal (s.13); and nomination (s.14). They can also withdraw consent at any time (s.6(4)).
How long does a company have to respond to a grievance?
Rule 14(3) caps the published grievance response period at 90 days. Each fiduciary publishes its own period within that limit and must keep to it.
Can a Data Principal complain directly to the Board?
Only after exhausting the Data Fiduciary's or Consent Manager's grievance redressal (s.13(3)). The Board has no members yet.
What is nomination under DPDP?
A Data Principal can nominate another person to exercise their rights in the event of their death or incapacity (s.14).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin