Right to access information
A person can ask a Fiduciary she gave consent to, including under section 7(a), for a summary of her personal data and the processing done. She can also ask for the identities of all other Fiduciaries and Processors it was shared with, with a description of what was shared.
The sharing details need not be given for sharing with a Fiduciary authorised by law to obtain the data, made on its written request. That exception covers sharing to prevent, detect or investigate offences or cyber incidents, or to prosecute or punish offences.
Sources: Act s.11
Correction and erasure
She can ask for her data to be corrected, completed, updated or erased. The Fiduciary must correct inaccurate or misleading data, complete incomplete data and update it. It must erase on request unless the data is still needed for the specified purpose or a law requires keeping it.
Sources: Act s.12
Grievances: 90 days, and the first stop
People have a right to readily available grievance redressal from a Fiduciary or Consent Manager. Rule 14(3) sets the response period at no more than 90 days, backed by measures that make the system effective. A person must exhaust this route before approaching the Board.
Sources: Act s.13Rules r.14(3)
Nomination
A person may nominate one or more individuals to exercise her rights if she dies or becomes incapable. Incapacity means being unable to exercise the rights because of unsoundness of mind or infirmity of body.
Sources: Act s.14Rules r.14(4)
How requests are made (Rule 14)
The Fiduciary, and a Consent Manager where relevant, must prominently publish how to make a request and which identifier it needs. Examples are a customer ID, application number, email address, mobile number or licence number. Every reply must include the contact person's details.
Sources: Rules r.14(1)Rules r.14(2)Rules r.14(5)Rules r.9
Duties of Data Principals
People also have duties: follow applicable laws, not impersonate anyone, and not suppress material information for State-issued identity documents. They must not file false or frivolous grievances or complaints, and must give only verifiably authentic information for correction or erasure. Breach can attract a penalty of up to Rs 10,000.
The Board may also warn or impose costs on a complainant if it finds a complaint false or frivolous.
Sources: Act s.15Act s.28(12)Act Schedule item 5
Key points
- Four rights: access, correction and erasure, grievance, nomination.
- Grievances must be answered within 90 days at most.
- People must use the Fiduciary's grievance route before the Board.
- Publish how to make a request and which identifier you need.
- Breaching people's duties can attract up to Rs 10,000.
In practice
A checklist for your organisation.
- Publish a rights request page listing the identifiers you accept.
- Track every grievance against a 90-day clock.
- Keep a sharing register so access replies can name recipients.
- Offer a nomination option in the customer account.
- Include the contact person in every rights reply.
Check what you learned
5 questions. Choose an answer to see why it is right.
0 of 5 answered
Question 1 of 5
What is the longest period the Rules allow for responding to a grievance?
Show the answer
C. 90 days
Rule 14(3) requires grievances to be answered within a reasonable period not exceeding ninety days.
Rules r.14(3)Rule 14(3) requires grievances to be answered within a reasonable period not exceeding ninety days.
Rules r.14(3)Question 2 of 5
Before approaching the Board, what must a person do?
Show the answer
C. Exhaust the Fiduciary's grievance redressal
Section 13(3) requires the Data Principal to exhaust the grievance redressal opportunity before approaching the Board.
Act s.13(3)Section 13(3) requires the Data Principal to exhaust the grievance redressal opportunity before approaching the Board.
Act s.13(3)Question 3 of 5
When may a nominee exercise a person's rights?
Show the answer
B. In the event of her death or incapacity
Section 14(1) lets the nominee exercise the rights in the event of death or incapacity of the Data Principal.
Act s.14(1)Section 14(1) lets the nominee exercise the rights in the event of death or incapacity of the Data Principal.
Act s.14(1)Question 4 of 5
Which is an example of an 'identifier' under Rule 14(5)?
Show the answer
A. A customer acquisition form number
Rule 14(5) lists identifiers issued by the Fiduciary, including a customer acquisition form number, email address and mobile number.
Rules r.14(5)Rule 14(5) lists identifiers issued by the Fiduciary, including a customer acquisition form number, email address and mobile number.
Rules r.14(5)Question 5 of 5
What is the maximum penalty for a Data Principal who breaches her duties under section 15?
Show the answer
B. Rs 10,000
Item 5 of the Schedule: breach of the section 15 duties may attract up to ten thousand rupees.
Act Schedule item 5Item 5 of the Schedule: breach of the section 15 duties may attract up to ten thousand rupees.
Act Schedule item 5
Official sources for this lesson
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)
- G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force
A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the DPDP dictionary.