DPDP · Data Principal
Data Principal Rights Under DPDP
A Data Principal is the individual to whom personal data relates. Chapter III of the Act sets rights of access, correction and erasure, grievance redressal and nomination — distinct from the duties in Section 15.
What Data Principal rights mean
Under Section 2(j), a Data Principal is the individual to whom the personal data relates. Where the Act deals with a child, references to the Data Principal include the parent or lawful guardian acting in that context. Rights in Chapter III are the individual’s tools to understand and influence how their personal data is handled.
Section 11 — Right to access information.A Data Principal may obtain a summary of personal data being processed and related processing information, including the identities of other Data Fiduciaries and Data Processors with whom the personal data has been shared, subject to the Act. This is about transparency into what is held and how it moves — not an unlimited dump of every system log.
Section 12 — Right to correction and erasure.A Data Principal may seek correction of inaccurate or misleading personal data, completion of incomplete data, updating of personal data, and erasure of personal data in accordance with the Act. Erasure interacts with retention rules: data may need to be kept where another law requires retention, and Fiduciaries erase when data is no longer necessary for the specified purpose unless law requires otherwise.
Section 13 — Right of grievance redressal.A Data Principal has the right to readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager concerning the performance of obligations or the exercise of rights. Ready availability matters: buried, unstaffed channels undermine the right in practice.
Section 14 — Right to nominate.A Data Principal may nominate another individual who shall, in the event of death or incapacity of the Data Principal, exercise the Data Principal’s rights in accordance with the Act. Nomination is a rights-continuity mechanism, not a general power of attorney for all commercial matters.
What it means in practice
Rights require operational machinery. Access requests need searchable inventories of personal data and processing activities, plus a defined intake and response process. Correction and erasure need connections to systems of record and downstream processors so changes propagate. Grievance channels need ownership, SLAs aligned to applicable Rules once commenced, and an escalation path. Nomination needs a way to record nominees and authenticate them when rights must be exercised.
Treat each right as a workflow: identify the request type, verify the requester where appropriate, locate the data, apply legal holds or retention exceptions, respond, and keep an audit trail of what was done. Policy language alone does not satisfy Sections 11–14.
Where organizations implement request workflows, a Consent Management Platform can support related consent and preference context that often sits beside rights handling — for example, showing purpose-linked consent state when a Principal asks what processing is based on consent. That is operational support for Fiduciary processes, not a substitute for legal assessment of each request.Explore Consent Management Platformfor consent lifecycle tooling that can sit alongside those workflows.
Section 15 duties are not rights
Section 15 sets duties of Data Principals. They include complying with applicable law while exercising rights or giving consent; not impersonating another person while providing personal data; not suppressing material information when applying for documents, unique identifiers or services from the State or its instrumentalities; not registering a false or frivolous grievance or complaint; and furnishing only verifiably authentic information when seeking correction or erasure. These duties constrain how rights are exercised — they are not additional rights of the Data Principal, and should never be labelled as such in policies or product copy.
Common mistakes
- Listing Section 15 duties in a “Your rights” section of a privacy notice.
- Publishing rights text without an intake channel, owner or response process.
- Handling erasure requests without checking statutory retention or other lawful processing grounds that may still apply.
- Ignoring nomination until a death or incapacity event occurs, with no record of nominees.
Official source
ConsentifyAI’s explanation is educational. Authoritative text is published by the Government of India / MeitY.
Information on this page is provided for general educational and implementation-planning purposes. It is not legal advice. Organizations should assess their specific obligations with qualified legal or privacy professionals.