The DPDP Act gives individuals the right to a summary of their data and how it is used, to have it corrected, completed or erased, to have grievances addressed, and to nominate someone to act for them. Organisations should publish how to make a request and respond within the period set by the Rules.
- Know who handles requests before the first one arrives.
- Publish a clear way to make a request and a grievance contact.
- Keep a simple log of requests and responses.
The rights in the Act
| Right | Section | What it means |
|---|---|---|
| Access to information | s.11 | A summary of the personal data being processed and the processing activities, and the identities of other fiduciaries and processors it was shared with |
| Correction and erasure | s.12 | To have inaccurate data corrected, incomplete data completed, data updated, or data erased once its purpose is served, unless law requires it to be kept |
| Grievance redressal | s.13 | To have a complaint dealt with by the organisation before approaching the Board |
| Nomination | s.14 | To nominate another person to exercise their rights in case of death or incapacity |
Duties of individuals
Section 15 also gives Data Principals duties, for example not to file false or frivolous complaints and not to impersonate others. These matter mostly to the Board, but they are a reminder that requests should be verified.
What the Rules ask you to publish
As we read Rule 14, an organisation must publish on its website or app the way for a person to make a request, and the information needed to verify the person. It must also set a response time for grievances, which the Rules say should not exceed 90 days. Confirm the exact wording in the Rules.
A simple request process
- Name one person or role to receive requests, and give a contact email.
- Acknowledge each request and check the person’s identity.
- Find the data across systems: CRM, spreadsheets, messaging apps, billing and vendors.
- Respond within the period you published, and record what you did.
- Update vendors if data was corrected or erased.
Where small organisations struggle
- Data scattered across personal phones and spreadsheets
- No single place to search for a person’s records
- Vendors who cannot delete data on request
- Staff who do not know who handles requests
Frequently asked questions
Do I have to delete everything when asked?
Erasure applies once the purpose is served and unless law requires retention. You may need to keep some records, such as invoices, for legal reasons. Explain what you kept and why.
Who decides if a complaint reaches the Board?
The individual first raises it with your organisation. If it is not resolved or answered, they may complain to the Data Protection Board.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.