Data Principal Rights
← All postsEmployee Exits Under DPDP: Offboarding, Ex-Employee Requests and Data Leakage
Exits create two DPDP risks. First, leavers who take customer or employee data with them can cause a personal data breach your organisation must report. Second, former employees remain Data Principals: their records must be kept only as long as the law requires, and their requests and grievances must be handled properly. A good offboarding process revokes access promptly, checks for data exfiltration, settles retention, and treats references and alumni programmes as separate purposes.
DSAR Process Under DPDP: From Request to Resolution Without the Email Chaos
A rights request looks simple to the person who sends it, but inside an organisation it can touch identity checks, a dozen systems, several vendors and a legal decision. Under the DPDP Act, a dependable process has a published intake, a defined state machine, identity verification without over-collection, data discovery driven by your ROPA, documented exception decisions, and evidence of every step. Grievances must be resolved within 90 days; set much shorter targets for requests.
ReadData Principal Rights Under DPDP: The Complete List (and What Isn't on It)
The DPDP Act gives individuals four rights: access to information (Section 11), correction and erasure (Section 12), grievance redressal (Section 13) and nomination (Section 14). Access and correction rights apply to data processed on consent or provided voluntarily. Unlike the GDPR, there is no right to data portability and no general right to object. Individuals also owe duties under Section 15. Businesses must publish how to make requests and resolve grievances within 90 days.
ReadGet started
Get DPDP-ready, well before the deadline
See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.