Data Principal Rights under the DPDP Act, 2023: A Practical Guide for Individuals and Businesses

Introduction: From Understanding to Implementation

India’s Digital Personal Data Protection Act, 2023 (DPDPA) gives every individual, called a Data Principal, enforceable rights over her personal data. These rights sit in Sections 11 to 14, and the matching duties sit in Section 15.

For Indian businesses, the debate is no longer about what the law says. The real task now is to embed it in daily operations. Every company that collects personal data, called a Data Fiduciary, must be ready to answer requests, correct records, erase data and resolve complaints.

The Act is built on a simple principle: transparency breeds trust. It aims at accountability (being answerable for one’s actions) and gives individuals real control over how their information is used.

The rights at a glance:

Section	Right or duty	In simple words
Section 11	Right to access information	Know what data is held, how it is used, and who it is shared with
Section 12	Right to correction and erasure	Fix wrong data and delete data no longer needed
Section 13	Right to grievance redressal	Complain to the company first, then to the Data Protection Board
Section 14	Right to nominate	Appoint someone to act for you on death or incapacity
Section 15	Duties of Data Principals	Use these rights honestly and lawfully

As the maxim goes, ubi jus ibi remedium (where there is a right, there is a remedy). The DPDPA pairs each right with a practical route to enforce it.

Right to Access Information about Personal Data (Section 11)

Section 11 is the cornerstone (the foundation on which everything rests) of transparency under the DPDPA. It ensures that a person is never left in the dark about what happens to her data after she hands it over.

The right is available against any Data Fiduciary to whom she gave consent. It also covers data processed under Section 7(a), where she voluntarily provided data for a specified purpose and did not object to its use. So the right reaches even data processed without formal consent.

The request must be made in the manner prescribed under the Digital Personal Data Protection Rules.

What a Data Principal can ask for

1. A summary of personal data being processed. This may include her name, contact details, identity information or account details.
2. A summary of processing activities. Processing means any operation on data, such as collection, storage, use, sharing, alteration or erasure.
3. The identities of other Data Fiduciaries and Data Processors with whom her data has been shared, with a description of the data shared with each.
4. Any other information prescribed by the Rules (Section 11(1)(c)). This clause lets subordinate legislation(rules made by the government under the parent Act) widen the scope of disclosure.

Example: A customer gives his/her name, phone number and address to an online shopping platform. The platform shares these with a courier company. He/She can ask for the courier company’s name and a description of the data shared with it.

Example: A borrower applies for a loan on a digital lending app. He/She can request a summary of the data the app holds and how it is being handled.

What the right does not cover

The right is not a key to every internal record. It does not, by itself, entitle a person to source code, internal databases, contracts between companies, security arrangements or confidential business documents. The entitlement is limited to the summaries and identities listed in the Act and Rules.

The law-enforcement exception (Section 11(2))

A Data Fiduciary need not disclose the recipient’s identity, or other prescribed information, when it shares data with another Data Fiduciary for law-enforcement purposes. All three conditions must be met:

• Legal authority: the recipient must be authorised by law to obtain the data.
• Written request: the sharing must follow a request made in writing.
• Specified purpose: the request must be for the prevention, detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.

This is not a blanket (covering everything without distinction) exemption for every disclosure to a government body. The exception must be read strictly (narrowly, without stretching its words), as exceptions to a right always are.

Why it matters: Section 11 tells individuals how to frame an access request. It also helps lawyers judge whether a company’s reply is adequate and whether a grievance should follow.

Right to Correction and Erasure of Personal Data (Section 12)

Section 12 lets a Data Principal keep her data accurate and have it deleted once it is no longer needed. Both rights apply to data processed with her consent, including under Section 7(a).

Correction, completion and updating (Sections 12(1) and 12(2))

If a company holds data that is inaccurate, misleading, incomplete or outdated, the individual can ask it to:

• correct wrong details,
• complete missing details, and
• update old details.

Example: A bank’s records show a customer’s old address and an outdated phone number. The customer can ask the bank to correct and update them.

Once a valid request is received, the Data Fiduciary is under a positive obligation (a duty to take action, not merely to refrain from wrongdoing) to act on it. It cannot keep relying on wrong records.

Erasure (Section 12(3))

A Data Principal may ask the Data Fiduciary to erase her personal data in the prescribed manner. The company must erase it unless retention is:

• necessary for the specified purpose, or
• required by any law in force.

Example: A customer closes her account on a shopping website and asks for deletion. The platform must erase her data once it is no longer needed. However, invoices and transaction records may have to be kept to meet tax or accounting laws.

The right to erasure is therefore qualified (limited by conditions), not absolute. It strikes a balance between an individual’s privacy and a company’s lawful need to retain certain records. In the words of the maxim cessante ratione legis, cessat ipsa lex (when the reason for a law ceases, the law itself ceases), once the purpose ends, the justification for holding the data ends too.

Right to Grievance Redressal (Section 13)

Section 13 gives a Data Principal a formal channel to complain when a Data Fiduciary or Consent Manager mishandles her data, ignores its legal duties or denies her rights.

The right works in three steps:

1. An accessible mechanism. Every Data Fiduciary and Consent Manager must provide a readily available (easy to find and use) means of raising complaints.
2. A timely response. The complaint must be answered within the period prescribed under the DPDP Rules.
3. The Board as the next step. The Data Principal must first exhaust (fully use up) the company’s internal mechanism. Only then may she approach the Data Protection Board of India.

This “company first, Board next” model keeps minor disputes away from the regulator and gives organisations a fair chance to set things right. For businesses, a slow or careless grievance desk is not a small lapse. It is often the first piece of evidence a complainant will place before the Board.

The principle of vigilantibus non dormientibus jura subveniunt (the law helps the vigilant, not those who sleep on their rights) applies here. Individuals should record their complaints and the company’s replies with care.

Right to Nominate (Section 14)

Section 14 allows a Data Principal to nominate another individual to exercise her data rights if she dies or becomes incapable of acting.

The right has three parts:

• Nomination: she may nominate a person in the manner prescribed by the Rules.
• On death: the nominee may exercise her rights under the Act and Rules.
• On incapacity: if she cannot act because of unsoundness of mind or physical infirmity (weakness or illness of the body), the nominee may act on her behalf.

A nominee is a custodian (a person entrusted to look after something), not an owner. The nominee does not inherit the personal data. The role is only to exercise the rights the Act gives.

This provision prevents a person’s data rights from becoming illusory (existing in name but not in practice) when she can no longer assert them herself.

Duties of Data Principals (Section 15)

Rights under the DPDPA come with duties. Section 15 requires individuals to act honestly and lawfully when dealing with Data Fiduciaries and the Board. As the maxim says, ex turpi causa non oritur actio (no action arises from a dishonest cause).

A Data Principal must:

1. Comply with all applicable laws while exercising her rights. The rights cannot be used as a tool for unlawful ends.
2. Not impersonate anyone. Using another person’s identity to open an account or obtain a service is not bona fide(in good faith), and no protection can be claimed for it.
3. Not suppress material information when providing data for any document, unique identifier, or proof of identity or address issued by the State or its instrumentalities.
4. Not register false or frivolous complaints with a Data Fiduciary or the Board.
5. Provide verifiably authentic information when seeking correction or erasure. A person seeking a name change in records should support it with genuine documents, not fabricated (falsely made) ones.

A breach of these duties can attract a penalty of up to ₹10,000 under the Schedule to the Act. These duties help companies and the Board separate genuine requests from vexatious (made only to annoy or harass) ones.

What This Means for Businesses

Every right under Sections 11 to 14 creates a matching operational duty for the Data Fiduciary. A company that cannot answer a request on time is exposed to complaints before the Data Protection Board and to penalties under Section 33.

A practical compliance checklist:

• Map what personal data you hold, where it sits and who you share it with.
• Keep an up-to-date list of all Data Processors and third-party recipients.
• Build a simple process to receive, verify and answer access requests.
• Set up a workflow to correct, update and erase data, with a retention schedule that records legal holds.
• Publish an easy-to-use grievance channel and track response timelines.
• Enable nomination for users and verify a nominee’s authority before acting.
• Train staff to spot impersonation and fabricated documents.

How AgreyaLegal can help

AgreyaLegal advises companies on DPDPA compliance, from data mapping and privacy notices to grievance systems and Board proceedings. We help businesses protect personal data and defend themselves against litigation and regulatory claims. Prevention, as every lawyer knows, is cheaper than litigation.

Frequently Asked Questions

1. How can I know whether a company is using my personal data lawfully?

Review its privacy notice, consent request and stated purposes, and compare them with what it actually does. You can also file an access request under Section 11 to see what data it holds and who it shares it with.

2. Can a company collect my personal data without informing me?

A company must follow the Act’s rules on notice, consent or permitted legitimate uses. Whether a particular collection is lawful depends on the circumstances and on whether the company had a valid legal basis.

3. Can I withdraw consent after giving it to a company or app?

Yes. Where processing is based on consent, you may withdraw it at any time. The company should make withdrawal as easy as giving consent, and you should understand its consequences, such as losing access to a service.

4. What if a company keeps using my data after I withdraw consent?

Keep a record of your withdrawal and the company’s later conduct. A lawyer can help you file a formal grievance, seek an explanation and assess remedies before the Board. Note that withdrawal does not always mean erasure: data required by law may still be kept.

5. Can a company force me to consent to unnecessary data collection?

Consent must be limited to data necessary for the stated purpose. Whether a demand is excessive depends on the purpose, the necessity of the data and the terms offered. A lawyer can assess whether the consent mechanism complies with the Act.

6. Can I claim compensation if a company violates my data rights?

Not automatically. Under Section 33, the Data Protection Board can impose monetary penalties after an inquiry and a hearing. These penalties are regulatory and go to the Consolidated Fund of India, not to the affected person. A complaint to the Board is therefore not a claim for personal compensation. Any claim for damages must be pursued separately under other applicable laws.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts