Glossary
What are Data Principal rights under DPDP?
Data Principal rights are what an individual can ask of a Data Fiduciary under the DPDP Act. Rule 14 sets how requests are made.
Definition
Data Principal rights are the rights in ss.11 to 14 of the DPDP Act, 2023: access to information (s.11), correction, completion, updating and erasure (s.12), grievance redressal (s.13) and nomination (s.14). A Data Principal may also withdraw consent at any time (s.6(4)). Rule 14(3) caps the grievance response period a Data Fiduciary publishes at 90 days.
What it means
A Data Principal can ask what personal data you hold and how you process it, have it corrected or erased, complain, and nominate someone to act on death or incapacity. Rule 14 requires you to publish how to make a request and what identifier is needed.
Rights and grievance duties start for Data Fiduciaries on 13 May 2027. See rights of the Data Principal and Rule 14.
Where it appears in the Act and Rules
| Provision | Right |
|---|---|
| s.11 | Access: a summary of personal data and processing, and the identities of other fiduciaries and processors it was shared with |
| s.12 | Correction, completion, updating and erasure |
| s.13 | Grievance redressal, exhausted before approaching the Board (s.13(3)) |
| s.14 | Nomination for death or incapacity |
| s.6(4) | Withdraw consent at any time |
| Rule 14 | Publish how to make requests and the identifier needed; grievance period of at most 90 days (Rule 14(3)) |
Common misconceptions
- “Data Principals can complain to the Board first.” s.13(3) requires them to exhaust the fiduciary's grievance redressal first.
- “Every request gets 90 days by law.” The 90-day cap in Rule 14(3) is for the published grievance response period. Close requests sooner where you can.
- “Access means a copy of every record.” s.11 is a right to a summary of personal data and processing, plus who it was shared with.
Related terms
Deleting personal data on request or when the purpose ends (s.8(7), s.12).
CorrectionCorrecting, completing and updating personal data (s.12).
NominationNaming a person to exercise rights on death or incapacity (s.14).
Grievance redressalThe fiduciary's complaint process, used before the Board (s.13).
In TruePrivacy
Data Principal requests handles access, correction, erasure, consent withdrawal and nomination, with identity verification before work starts, tasks fanned out to connected systems, email templates and an audit trail. TruePrivacy runs every rights request and grievance against the 90-day outer limit, so you can close them sooner.
What rights does a Data Principal have under DPDP?
Access to information (s.11), correction, completion, updating and erasure (s.12), grievance redressal (s.13) and nomination (s.14). Consent can also be withdrawn at any time (s.6(4)).
How long can a Data Fiduciary take to resolve a grievance?
Rule 14(3) caps the published grievance response period at 90 days. Publish your own period within that limit and keep to it.
When do these duties start?
Rule 14 and the other core obligations begin on 13 May 2027.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin