Module 7 of 9Sections 11 to 147 min including the detail
What people can demand, and what they owe
Four rights, one nomination mechanism, and a set of duties on the individual that most summaries of this Act leave out entirely.
Access, correction, erasure, grievance
Four rights, and the one nobody is ready for is naming every other Fiduciary the data was shared with.
What a person can demand
- A summary of the dataand of the processing you have undertaken
- The recipientsthe identities of other Fiduciaries it went to
- Correctioncorrected, completed or updated
- Erasuredeleted, with no reason required
- A grievanceanswered within the period the Rules prescribe
The detail, if you want it
A person may obtain a summary of the personal data you hold and the processing activities you have undertaken, and the identities of other Fiduciaries with whom it has been shared. That last part is the one nobody is ready for: it requires knowing where data went, not just what you hold.
They may have data corrected, completed or updated, and erased. They may raise a grievance with you, and you must respond within the period the Rules prescribe. Exhausting your grievance route is a precondition to approaching the Board, which makes your route the first line of defence rather than an inconvenience.
Nomination is a right, and an unusual one
A person may nominate someone to exercise their rights on death or incapacity. Few systems built for other regimes have anywhere to put it.
The detail, if you want it
A person may nominate another individual to exercise their rights on their behalf in the event of death or incapacity. Few systems built for other privacy regimes have anywhere to put this, so it tends to be discovered late.
The Data Principal has duties too
Individuals must not impersonate, suppress information or file frivolous grievances. This is the basis on which you may verify identity before acting.
the penalty for a Data Principal breaching their own duties
Six orders of magnitude below the organisational ceilings, and it matters operationally rather than punitively.
The detail, if you want it
The Act places duties on individuals: not to impersonate, not to suppress material information, not to file false or frivolous grievances, and to furnish only authentic information when exercising the right to correction. Breach of these can attract a penalty of up to ₹10,000.
This matters operationally rather than punitively. It is the basis on which you may verify identity before acting on a request, and the reason a process that hands over a data summary to anyone who emails in is itself a risk.
The three things to remember
- An access request wants the data, a summary of the processing, and who else received it.
- Your own grievance route is the precondition to the Board, so an unanswered route is a fast path to the regulator.
- Nomination exists in this Act, and most systems built for other regimes have nowhere to record it.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- One route that serves all four rights, with a recorded date received and date actioned for each request.
- An identity verification step proportionate to what is being asked for.
- The ability to answer with whom personal data has been shared, per person, not per policy.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.