The DPDP Act gives every Data Principal (the individual whose data you hold) a set of enforceable rights. If you are a Data Fiduciary, these are not abstract — they are requests you must be able to receive and act on. Here are the four, and what they require of you.
1. Right to access information (Section 11)
A person can ask for a summary of the personal data you hold about them, the processing activities, and the identities of other Data Fiduciaries and processors with whom you have shared it. In short: what do you have, what are you doing with it, and who else has it.
2. Right to correction and erasure (Section 12)
A person can ask you to correct, complete, update or erase their personal data. You must correct or complete inaccurate data, and erase data unless retention is required for a legal purpose. When the purpose is over and the law does not require you to keep it, erasure is the default.
3. Right of grievance redressal (Section 13)
You must provide a readily available grievance-redressal mechanism and respond within a period that the Rules prescribe. A person must exhaust this channel before approaching the Board. A real grievance channel — not a dead inbox — is a specific legal requirement.
4. Right to nominate (Section 14)
A person can nominate another individual to exercise their rights in the event of death or incapacity — a genuinely new feature of Indian data law that you should be able to record and honour.
Duties of the Data Principal
The Act is two-sided: Data Principals must not file false or frivolous complaints or impersonate others. But this does not dilute your obligations — you still have to build the machinery to serve genuine requests.
How to action requests, step by step
- Intake — a published, easy route to make a request.
- Verify identity — confirm the requester is who they claim, without collecting excess data.
- Locate the data — which is only possible if you have a data map.
- Act — access summary, correction, erasure, as applicable.
- Respond within time — and log what you did.
- Propagate — pass correction/erasure to processors who also hold the data.
Why a log matters
As with consent, the burden is on you to show you handled rights properly. An auditable record of each request and your response is what demonstrates compliance if a complaint reaches the Board.
How DPDP Bridge helps
DPDP Bridge gives you a ready data-principal rights workflow and a grievance-redressal channel — intake, identity checks, task routing and an auditable log of every request and response, within the timelines the Rules expect. Start with the free assessment.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.