Sections 11–14 · Rule 14
Data principal requests (DSR) under DPDP
Every request has an owner, a clock and a trail. TruePrivacy verifies the person, sends tasks to connected systems and tracks the deadline.
Sample workspace
Open requests
- DPR-1042ErasureDay 12 of 90
- DPR-1039AccessDay 41 of 90
- DPR-1036CorrectionDay 58 of 90
- DPR-1031NominationClosed on day 9
DPR-1042
- Identity verified
- Tasks sent to 3 connected systems
- Reply with Rule 9 contact
Short answer
The DPDP Act gives Data Principals the right to access information (s.11), to correction and erasure (s.12), to grievance redressal (s.13) and to nominate (s.14). Rule 14 asks you to publish how to make a request and which identifier is needed, and Rule 14(3) caps your published grievance response period at 90 days. TruePrivacy runs every rights request and grievance against that outer limit, so you can close them sooner.
What rights request handling covers
The rights of Data Principals apply with the core obligations from 13 May 2027. A single request can touch every system that holds a person's data, so each one needs an owner, a clock and a record.
Access, correction, erasure, consent withdrawal and nomination requests.
Identity verification happens before work starts, so you act for the right person.
Work fans out as tasks to your connected systems.
Every request runs on a clock with the DPDP 90-day outer limit, so late work shows early.
Write replies once, including the Rule 9 contact you must mention in every response.
Every action is logged with before and after values, exportable as CSV.
How a request moves from intake to close
- 01Intake
The person submits through your privacy center. Publish there how to make a request and the identifier needed (Rule 14).
- 02Verify identity
Confirm the person before any work starts.
- 03Fan out tasks
Tasks go to the connected systems that need to act, and each one shows on the audit trail.
- 04Respond and close
Reply with an email template that names your Rule 9 contact. For an access request, the person can download their data through a secure link.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Summary of personal data and processing, and who it was shared with | s.11 | Access requests, with a secure download link through the privacy center |
| Correction, completion, updating and erasure | s.12 | Correction and erasure requests fanned out as tasks to connected systems |
| Nominate someone to exercise rights on death or incapacity | s.14, Rule 14 | Nomination requests |
| Publish how to make requests and the identifier needed | Rule 14 | A privacy center where people submit requests and check status |
| Mention the contact for questions in every response | Rule 9 | Email templates you write once and reuse |
| Published grievance response period of at most 90 days | Rule 14(3) | A 90-day outer-limit clock on rights work and grievances |
Limits to plan for
Rule 14(3) caps the grievance response period you publish at 90 days. TruePrivacy also tracks rights work against that outer limit, so your team can close it sooner. Which identifier you accept, and when an exemption applies, are decisions to make with counsel.
If a person is unhappy with how you handled a request, s.13(3) asks them to exhaust your grievance redressal before approaching the Board. The request handling guide walks through each request type in more detail.
Works with
A branded portal where people submit requests and check status.
Grievance redressalA grievance desk with categories, SLA states and escalation.
IntegrationsThe connected systems that receive request tasks.
Retention and erasureRetention rules and an executions log for erasure beyond single requests.
How long do I have to answer a DPDP rights request?
Rule 14(3) caps the grievance response period you publish at 90 days. TruePrivacy tracks rights work and grievances against that outer limit, so you can close them sooner.
Which rights does the DPDP Act give?
Access to information (s.11); correction, completion, updating and erasure (s.12); grievance redressal (s.13); and nomination (s.14). Consent can also be withdrawn at any time (s.6(4)).
Do I have to verify identity?
Rule 14 asks you to publish the identifier a person needs to make a request. TruePrivacy runs identity verification before work starts on a request.
Can a Data Principal download their data?
Yes. The privacy center lets people download their data through a secure link.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin