Home
Tools
Data principal request form template

Template

Data principal request form template

A form people can use to ask for access, correction, completion, updating or erasure, to nominate someone, or to raise a grievance. Copy it, add your details and check it with counsel.

Open the template All tools

Updated 4 Nov 2026

Short answer

Under the DPDP Act, Data Principals can ask for access (s.11), correction, completion, updating and erasure (s.12), can nominate someone (s.14) and can raise grievances (s.13). Rule 14 asks you to publish how to make a request and the identifier you need, and Rule 14(3) caps the grievance response period you publish at 90 days. This template is one intake form for all of them; adapt it with counsel.

Copy or print this form and adapt it to your services. Fields ending in a colon are for the person to fill in. Check the final wording with counsel.

Data Principal request form

About this form

Use this form to exercise your rights under the Digital Personal Data Protection Act, 2023, or to raise a grievance.

We respond within the period published on our website.

We may ask for information to confirm your identity before we act on your request.

1. Your details

Full name:

Email address:

Mobile number (optional):

If you are making this request for someone else, your relationship to them (parent, lawful guardian or nominee):

2. Identifier

We use the identifier below to find your records. It is the identifier we publish on our website.

Username, customer ID or other identifier:

3. Request type (tick one or more)

[ ] Access: a summary of my personal data and how it is processed (s.11)

[ ] Correction of my personal data (s.12)

[ ] Completion of my personal data (s.12)

[ ] Updating of my personal data (s.12)

[ ] Erasure of my personal data (s.12)

[ ] Nomination of a person to exercise my rights in the event of my death or incapacity (s.14)

[ ] Grievance about how my personal data or a request was handled (s.13)

4. Details of your request

Which personal data, account or service this concerns:

What you would like us to do:

For correction, completion or updating, the correct details:

For nomination, the nominee's name and contact details:

For a grievance, what happened and when:

5. Declaration

I confirm that the information in this form is true, and that I am the Data Principal or am entitled to act for them.

Signature or typed name:

Date:

For office use

Reference number (sample format: DPR-1042):

Date received:

Identity verified on:

Response due by (within our published period):

Assigned to:

Closed on:

What the form collects

Your details: name and contact, and the relationship if someone is acting for the Data Principal
Identifier: the username or other identifier you publish under Rule 14(1)
Request type: access, correction, completion, updating, erasure, nomination or grievance
Details: which data or service, and what the person wants done
Declaration: that the information is true and the person may act
Office use: reference, dates and owner, filled in by your team

Ask only for what you need to find and verify the person. The identifier field should match what you publish under Rule 14(1).

Setting and publishing your response period

Rule 14(3) asks each Data Fiduciary to publish the period for responding to grievances, and that period cannot exceed 90 days. Publish it next to the form and put measures in place to keep to it.

A shorter period is allowed. Using one period for rights work and grievances keeps the clock simple for your team.

Mention the contact who answers questions about processing in every response (Rule 9). A person must use your grievance process before approaching the Board (s.13(3)), as the Rule 14 guide explains.

Before you publish the form

Educational, not legal advice

This template is educational, not legal advice and not a certification. Adapt the wording, request types and verification steps to your services, and check with counsel, especially for requests made for a child, by a lawful guardian or by a nominee.

How TruePrivacy helps

The privacy center gives Data Principals a branded portal to submit requests and check their status. Data Principal requests verifies identity before work starts, fans tasks out to connected systems and tracks deadlines.

The grievance desk has categories, SLA states and escalation. TruePrivacy runs every rights request and grievance against the 90-day outer limit, so you can close them sooner.

Sources

Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025

Updated 4 Nov 2026. Educational information, not legal advice.

Questions, answered

Educational, not legal advice.

All DPDP FAQs

What rights can a Data Principal exercise under DPDP?

Access to information (s.11); correction, completion, updating and erasure (s.12); grievance redressal (s.13); and nomination (s.14).

How long do we have to respond to a grievance?

Rule 14(3) caps the grievance response period you publish at 90 days. Publish your period and keep to it; a shorter period is allowed.

What identifier should the form ask for?

Rule 14 asks you to publish the identifier you need to identify the person, such as a username. Ask for that, and no more data than you need to act.

Can someone make a request for another person?

Yes, in some cases. For a child, the Data Principal includes the parent or lawful guardian; for a person with disability, the lawful guardian acting for them; and a nominee can act on death or incapacity (s.14).

Keep reading

Your DPDP plan, starting today

Core obligations for data fiduciaries begin on 13 May 2027.

13 May 2027

Core obligations begin

Start your readiness assessment See pricing in INR