# Lesson 9: Rights and duties of people | Learn DPDP | FOCTTA > The four rights people have, how requests and grievances work under Rule 14, and the duties people owe in return. Web page: https://foctta.com/learn/rights-and-duties This Markdown copy has the same content as the web page. Built 2026-10-14. --- 1. [Home](https://foctta.com/) 2. [Learn DPDP](https://foctta.com/learn) 3. Lesson 9 Lesson 9 of 12 · 6 min read # Rights and duties of people The four rights people have, how requests and grievances work under Rule 14, and the duties people owe in return. Jump to the quiz ## Where things stand - Not yet in force. Sections 11 to 15 and Rule 14 start eighteen months after 13 November 2025, around May 2027. Checked 28 Sep 2026 Source: G.S.R. 843(E) para (c); Rules r.1(4) ## Right to access information A person can ask a Fiduciary she gave consent to, including under section 7(a), for a summary of her personal data and the processing done. She can also ask for the identities of all other Fiduciaries and Processors it was shared with, with a description of what was shared. The sharing details need not be given for sharing with a Fiduciary authorised by law to obtain the data, made on its written request. That exception covers sharing to prevent, detect or investigate offences or cyber incidents, or to prosecute or punish offences. Sources: Act s.11 ## Correction and erasure She can ask for her data to be corrected, completed, updated or erased. The Fiduciary must correct inaccurate or misleading data, complete incomplete data and update it. It must erase on request unless the data is still needed for the specified purpose or a law requires keeping it. Sources: Act s.12 ## Grievances: 90 days, and the first stop People have a right to readily available grievance redressal from a Fiduciary or Consent Manager. Rule 14(3) sets the response period at no more than 90 days, backed by measures that make the system effective. A person must exhaust this route before approaching the Board. Sources: Act s.13 Rules r.14(3) ## Nomination A person may nominate one or more individuals to exercise her rights if she dies or becomes incapable. Incapacity means being unable to exercise the rights because of unsoundness of mind or infirmity of body. Sources: Act s.14 Rules r.14(4) ## How requests are made (Rule 14) The Fiduciary, and a Consent Manager where relevant, must prominently publish how to make a request and which identifier it needs. Examples are a customer ID, application number, email address, mobile number or licence number. Every reply must include the contact person's details. Sources: Rules r.14(1) Rules r.14(2) Rules r.14(5) Rules r.9 ## Duties of Data Principals People also have duties: follow applicable laws, not impersonate anyone, and not suppress material information for State-issued identity documents. They must not file false or frivolous grievances or complaints, and must give only verifiably authentic information for correction or erasure. Breach can attract a penalty of up to Rs 10,000. The Board may also warn or impose costs on a complainant if it finds a complaint false or frivolous. Sources: Act s.15 Act s.28(12) Act Schedule item 5 ## Key points - Four rights: access, correction and erasure, grievance, nomination. - Grievances must be answered within 90 days at most. - People must use the Fiduciary's grievance route before the Board. - Publish how to make a request and which identifier you need. - Breaching people's duties can attract up to Rs 10,000. ## In practice A checklist for your organisation. - Publish a rights request page listing the identifiers you accept. - Track every grievance against a 90-day clock. - Keep a sharing register so access replies can name recipients. - Offer a nomination option in the customer account. - Include the contact person in every rights reply. ## Check what you learned 5 questions. Choose an answer to see why it is right. 0 of 5 answered 1. Question 1 of 5 ### What is the longest period the Rules allow for responding to a grievance? - 30 days - 45 days - 90 days - 180 days Show the answer **C. 90 days** Rule 14(3) requires grievances to be answered within a reasonable period not exceeding ninety days. Rules r.14(3) 2. Question 2 of 5 ### Before approaching the Board, what must a person do? - File a court case - Nothing - Exhaust the Fiduciary's grievance redressal - Hire a lawyer Show the answer **C. Exhaust the Fiduciary's grievance redressal** Section 13(3) requires the Data Principal to exhaust the grievance redressal opportunity before approaching the Board. Act s.13(3) 3. Question 3 of 5 ### When may a nominee exercise a person's rights? - At any time - In the event of her death or incapacity - Only for children - Only with Board approval Show the answer **B. In the event of her death or incapacity** Section 14(1) lets the nominee exercise the rights in the event of death or incapacity of the Data Principal. Act s.14(1) 4. Question 4 of 5 ### Which is an example of an 'identifier' under Rule 14(5)? - A customer acquisition form number - The Board's case number - The company's PAN - The DPO's name Show the answer **A. A customer acquisition form number** Rule 14(5) lists identifiers issued by the Fiduciary, including a customer acquisition form number, email address and mobile number. Rules r.14(5) 5. Question 5 of 5 ### What is the maximum penalty for a Data Principal who breaches her duties under section 15? - Rs 1,000 - Rs 10,000 - Rs 1 lakh - Rs 50 crore Show the answer **B. Rs 10,000** Item 5 of the Schedule: breach of the section 15 duties may attract up to ten thousand rupees. Act Schedule item 5 Try again[Next lesson: Sending data outside India](https://foctta.com/learn/cross-border) ## Official sources for this lesson - [The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), MeitY, 13 November 2025 (with Schedules)](https://egazette.gov.in/WriteReadData/2025/267650.pdf) - [G.S.R. 843(E), 13 November 2025: dates on which provisions of the DPDP Act come into force](https://egazette.gov.in/WriteReadData/2025/267647.pdf) A plain-English summary of the DPDP Act 2023 and DPDP Rules 2025, checked on 28 September 2026. It is not legal advice. Words in this lesson are explained in the [DPDP dictionary](https://foctta.com/glossary). [← Lesson 8 **Significant Data Fiduciaries**](https://foctta.com/learn/significant-data-fiduciaries) [Lesson 10 → **Sending data outside India**](https://foctta.com/learn/cross-border) **In this lesson** 1. Where things stand 2. Right to access information 3. Correction and erasure 4. Grievances: 90 days, and the first stop 5. Nomination 6. How requests are made (Rule 14) 7. Duties of Data Principals 8. Key points 9. In practice 10. Quiz Take the quiz