FAQ
Data Principal rights FAQ
Right-by-right answers for Data Fiduciaries preparing their request and grievance process.
Short answer
Under the DPDP Act, 2023, a Data Principal has the right to access information (s.11), to correction, completion, updating and erasure (s.12), to grievance redressal (s.13) and to nominate (s.14), and may withdraw consent at any time (s.6(4)). Rule 14(3) caps the grievance response period each Data Fiduciary publishes at 90 days. These duties apply to Data Fiduciaries from 13 May 2027.
Rights at a glance
| Right | Section | What the Data Fiduciary does |
|---|---|---|
| Access | s.11 | Gives a summary of personal data and processing, and the identities of other fiduciaries and processors it was shared with |
| Correction, completion, updating | s.12 | Fixes, completes or updates the data |
| Erasure | s.12, s.8(7) | Erases unless a law requires retention, and makes processors erase |
| Grievance redressal | s.13 | Resolves within the period it publishes, at most 90 days (Rule 14(3)) |
| Nomination | s.14 | Lets a nominee exercise rights on death or incapacity |
| Withdraw consent | s.6(4) | Makes withdrawal as easy as giving consent; stops processing within a reasonable time (s.6(6)) |
All questions
Educational, not legal advice.
What rights does a Data Principal have under DPDP?
Access to information (s.11), correction, completion, updating and erasure (s.12), grievance redressal (s.13) and nomination (s.14). Consent can also be withdrawn at any time (s.6(4)). See rights of the Data Principal.
What does the right to access cover?
A summary of the personal data and the processing, and the identities of other Data Fiduciaries and Data Processors it was shared with (s.11).
Does the right to erasure override legal retention?
No. s.8(7) requires erasure when consent is withdrawn or the purpose is no longer served, unless a law requires the data to be retained. See erasure.
How long can a Data Fiduciary take to resolve a grievance?
Rule 14(3) requires each Data Fiduciary and Consent Manager to publish its grievance response period, which shall not exceed 90 days, and to keep to it. TruePrivacy runs every rights request and grievance against that outer limit, so you can close them sooner.
Can a Data Principal go straight to the Board?
Not first. Under s.13(3), they must exhaust the Data Fiduciary's or Consent Manager's grievance redressal before approaching the Board. See grievance redressal.
What is nomination?
The right under s.14 to nominate a person who will exercise the Data Principal's rights in the event of death or incapacity.
How does a Data Principal make a request?
Through the means the Data Fiduciary publishes under Rule 14, using the identifier it says is needed. Every response must also include the contact published under Rule 9. See Rule 14.
Can a parent exercise rights for a child?
Yes. For a child, who is anyone under 18, the definition of Data Principal includes the parents or lawful guardian (s.2).
When do these rights take effect for businesses?
Rule 14 and the other core obligations begin on 13 May 2027.
How should we prepare?
Publish how to make requests and your grievance period, verify identity before acting, and send tasks to every system holding the data. Data Principal requests in TruePrivacy does this with deadline tracking and an audit trail, and the grievance desk adds categories, SLA states and escalation.
Keep reading
- Rights of the data principal under DPDP Sections 11 to 14
- Rule 14 data principal requests Rule 14
- Handle Data Principal requests well inside 90 days Rule 14
- Data principal requests (DSR) under DPDP Sections 11–14 · Rule 14
- Grievance redressal for DPDP fiduciaries Section 13 · Rule 14(3)
- Data Principal rights Glossary
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin