Your customers get clear rights over their data. They can ask what you hold, ask you to fix or delete it, withdraw consent, complain, and name someone to act for them if they die or cannot act. From 13 May 2027, you must make these requests easy and handle them properly.
What it means for you
- A customer can ask for a summary of her data and a list of the companies you shared it with.
- She can ask you to correct, complete, update or delete her data. Vendors that handle the data for you must do the same.
- You can keep data another law requires, such as tax records. Tell her what you kept and why.
- Publish how to make a request and how long you take to settle complaints, at most 90 days. That limit is for complaints only, so set your own shorter targets for other requests.
- She must complain to you before going to the Data Protection Board, the new regulator. Its members are not yet appointed.
What to do
- Put up one rights page with a request form, linked from your app and privacy notice.
- Publish your complaint response time and a contact person.
- Check identity with what you already hold, such as a one-time code, not new ID copies.
- For each system and vendor, write down how to export, correct and delete a person's data.
- Log every request with dates and the outcome.
The law: sections 11 to 15 of the DPDP Act and Rules 9 and 14 of the DPDP Rules, 2025. Applies from 13 May 2027.
Sections 11 to 14 of the DPDP Act give people the right to access a summary of their data, to correct, complete, update and erase it, to grievance redressal, and to nominate someone to act for them. From 13 May 2027, Rule 14 requires you to publish how to make requests and your grievance response period, which cannot exceed 90 days.
Key takeaways
- Rights cover access (s.11), correction, completion, updating and erasure (s.12), grievance redressal (s.13) and nomination (s.14).
- Rule 14 requires you to publish the means to make requests and the identifiers needed to identify the person.
- The 90-day maximum in Rule 14(3) applies to grievances; set and publish your own service levels for other requests.
- People must use your grievance process before they can complain to the Data Protection Board.
- Data Principals have duties too under section 15, with a penalty of up to ₹10,000 for breaching them.
Rights requests are where your data map gets tested by someone outside the company. A customer asks what you hold about her, or asks you to delete it, and your team has to find every copy across the app database, the CRM, the support desk, the warehouse and each vendor. Without a workflow, that becomes a manual hunt each time.
This guide sets out each right under the DPDP Act, what you must publish under Rule 14, how to verify identity, how processors fit, and how to build a request workflow. Sections 11 to 15 of the Act and Rule 14 apply from 13 May 2027.
What rights does a Data Principal have under DPDP?
A Data Principal is the person the data is about, and includes the parent or lawful guardian of a child and the lawful guardian of a person with disability (section 2(j)). The Act gives her the following rights.
| Right | Section | What the person can ask | What you must do | Exceptions and limits |
|---|---|---|---|---|
| Access | s.11 | A summary of her personal data and the processing; the identities of other fiduciaries and processors you shared it with, and a description of what was shared | Pull data from every system and processor, produce a clear summary, list recipients | Only against a fiduciary she gave consent to, including under s.7(a). Recipients need not be listed where data went to a fiduciary authorised by law, on its written request, to prevent, detect or investigate offences or cyber incidents (s.11(2)). Exemptions in s.17(1), such as investigation of offences or enforcing legal rights |
| Correction, completion, updating | s.12 | Fix inaccurate or misleading data, complete what is incomplete, update what has changed | Verify the change, apply it in every system and at processors | s.17(1) exemptions; you can ask for evidence where the change matters |
| Erasure | s.12, s.8(7) | Erase personal data | Erase it and make processors erase it | Retention still necessary for the specified purpose or required by law (s.12(3)); one-year retention of data and logs under Rule 8(3) |
| Withdraw consent | s.6(4) | Stop processing based on her consent | Stop within a reasonable time, make processors stop, then erase | Past processing stays lawful (s.6(5)); does not apply to section 7 legitimate uses |
| Grievance redressal | s.13 | Raise a complaint about how you handled her data or a request | Respond within your published period, not exceeding 90 days (Rule 14(3)) | Must be used before she can approach the Board |
| Nomination | s.14 | Nominate another individual to exercise her rights if she dies or becomes incapable | Record the nomination, verify the nominee when they act | Nominee acts only on the trigger event |
Section 17 exemptions are narrow and specific. Do not use them as a general reason to refuse; record the exemption relied on and why, for each refused request.
Through the channel you publish: app, web, email
Match the person to an identifier you hold
Decide who answers: you, or the customer you work for
Access, correct or delete, in every system and vendor
Record the outcome, within 90 days at most
What must you publish under Rule 14?
Rule 14 turns the rights into publishing duties. Prominently on your website or app, you must publish:
- The means to make a request (Rule 14(1)(a)): a web form, an in-app screen, an email address. Keep it findable from the notice and the privacy policy.
- The identifiers you need (Rule 14(1)(b)): the username or other identifier required to identify the person under your terms of service, such as a registered mobile number or customer ID.
- Your grievance response period (Rule 14(3)): a reasonable period, not exceeding 90 days, with technical and organisational measures to make sure you meet it.
Rule 9 adds one more: publish the business contact of your Data Protection Officer, if you have one, or of a person who can answer questions about processing, and include that contact in every response to a rights request.
Be precise about the 90 days
The 90-day cap in Rule 14(3) is for responding to grievances. It is not a deadline the Rules set for access, correction or erasure requests. Set your own service levels for those, publish them, and keep them well inside 90 days so a delayed request does not turn into a grievance.
Do you need a DPDP grievance officer?
Section 8(10) requires every fiduciary to have an effective mechanism to redress grievances. The Act does not require every company to appoint someone with the title “grievance officer”. What it does require, through section 8(9) and Rule 9, is a published business contact: your DPO if you are a Significant Data Fiduciary (whose DPO is the grievance contact), or otherwise a person who can answer questions about processing.
In practice, name an owner for grievances, give them authority to get answers from engineering and vendors, and track every grievance to closure with a date. Consent managers, once registered, must run their own grievance process too.
How do you verify identity without collecting more data?
Verify before you act. Sending a full data summary to the wrong person is itself a personal data breach. But verification should not become a reason to collect identity documents you never needed.
- Match to what you hold. Use the identifiers you published under Rule 14(1)(b): a one-time code to the registered mobile or email, or a request made from inside a logged-in account.
- Step up for higher risk. Access and erasure of sensitive data justify a second factor. A marketing opt-out does not.
- Verify representatives. For a parent or guardian, follow the same checks you use for verifiable parental consent. For a nominee, check the nomination record and evidence of death or incapacity.
- Do not keep verification artefacts longer than needed. Record that verification passed and how, not copies of documents.
Who answers: the fiduciary or the processor?
Rights are exercised against the Data Fiduciary. Section 8(1) keeps the fiduciary responsible for processing done on its behalf by processors. If you are a processor, for example a SaaS platform holding your customers' end-user data, requests that reach you belong to your customer.
If you are the fiduciary
- Receive, verify and decide on the request
- Fulfil it in your systems and instruct each processor
- Collect confirmations from processors
- Respond to the person with your Rule 9 contact
- Own the grievance if she is unhappy
If you are the processor
- Do not decide the request yourself
- Forward it to the right customer quickly
- Give customers tools to search, export, correct and erase
- Act on the customer's instruction, then confirm
- Write these duties into your contracts
Our guide to fiduciaries and processors covers how to tell which role you hold for each data set. Many companies hold both.
How do erasure and retention fit together?
An erasure request does not override a law that requires you to keep data. Tax, company and sector rules often do. Rule 8(3) also requires every fiduciary to keep personal data, associated traffic data and processing logs for at least one year from processing. So an erasure response often has two parts: what you deleted now, and what you must keep, why, and when it will be erased. Say so plainly in your reply. Our data retention guide covers the full schedule.
What duties do Data Principals have?
Section 15 places duties on the people exercising rights. A Data Principal must not impersonate another person, must not suppress material information when providing data for a State-issued document, identifier or proof of identity or address, must not register a false or frivolous grievance or complaint, must give only verifiably authentic information when seeking correction or erasure, and must comply with applicable laws while exercising rights. Breaching these duties can attract a penalty of up to ₹10,000.
For your team, section 15 is a reason to keep good records, not a reason to push back on requests. If you think a request is fraudulent, verify harder and document it.
When can someone complain to the Data Protection Board?
Only after exhausting your grievance redressal. Section 13 requires the person to use the grievance mechanism of the fiduciary or consent manager first. After that, she can complain to the Board. Board inquiries are to be completed within six months, extendable by three months at a time (Rule 19). Appeals against Board orders go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29).
The Board has been established, but as of November 2026 its Chairperson and Members have not been appointed. That does not change your timeline: Rule 14 and the rights sections apply from 13 May 2027, and we expect your grievance records to be among the first things the Board asks for.
How to build a rights request workflow
- Publish the channels. One rights page with a form and an in-app route, linked from your notices, with the Rule 14 identifiers and grievance period.
- Log every request. Ticket per request: type, date received, verification result, systems searched, outcome, response date.
- Map systems to rights. From your data inventory, list for each system how to export, correct and erase a person's data, and who does it.
- Automate the common paths. Self-service access export and marketing opt-out typically cover much of the volume.
- Instruct processors. A standard instruction and confirmation for each vendor holding the data.
- Template the replies. Include the Rule 9 contact, what was done, what was retained and why, and how to raise a grievance.
- Report monthly. Volumes, ageing against service levels, refusals and the exemption relied on.
The rights workflow is a core item in the DPDP compliance checklist. If you want us to build the intake, routing and fulfilment across your systems, see our services.
Frequently asked questions
What are the rights of a Data Principal under the DPDP Act?
The right to access information about personal data (s.11); to correction, completion, updating and erasure (s.12); to grievance redressal (s.13); and to nominate another person to exercise rights in the event of death or incapacity (s.14). People can also withdraw consent at any time under section 6(4).
Is there a right to erasure under DPDP?
Yes. Section 12 gives a right to erasure, and section 8(7) requires you to erase data when consent is withdrawn or the purpose is no longer served, and to make your processors erase it too. You can keep data where retention is still necessary for the specified purpose or required by law (s.12(3), s.8(7)), and Rule 8(3) requires processing logs and associated data to be kept for at least one year.
How long does a company have to respond to a DPDP grievance?
Rule 14(3) requires every fiduciary to publish its grievance response period, which must be a reasonable period not exceeding 90 days. The 90-day cap applies to grievances. For other rights requests, set and publish your own service levels.
Do I need a grievance officer under the DPDP Act?
The Act does not use the title grievance officer for every company. Section 8(10) requires an effective grievance redressal mechanism, and Rule 9 requires you to publish the business contact of your DPO, if you have one, or of a person who can answer questions about processing. Significant Data Fiduciaries must appoint a DPO who is the grievance contact.
Can someone complain directly to the Data Protection Board?
Not as a first step. Under section 13, a person must first use the grievance redressal mechanism of the fiduciary or consent manager before approaching the Board. The Board is established but its Chairperson and Members had not been appointed as of November 2026.
What is nomination under the DPDP Act?
Section 14 lets a person nominate another individual to exercise her rights if she dies or becomes incapable. You need a way to record nominations and to verify a nominee who later makes a request.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. We aim to send a proposal, usually at a fixed fee, within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.