Rights run against the Data Fiduciary you gave consent to — including consent treated as given under section 7(a). Requests are made in the prescribed manner, and grievances go to the Fiduciary before the Board.
11Right to access information about personal dataOn request, obtain a summary of the personal data being processed and the processing activities carried out, the identities of every other Data Fiduciary and Data Processor the data was shared with, and a description of what was shared.Limit: the sharing disclosure does not apply where data was shared with another Fiduciary authorised by law for prevention, detection or investigation of offences or cyber incidents. § 11(2)
12Right to correction and erasureOn a request to correct, complete or update, the Data Fiduciary must correct inaccurate or misleading data, complete what is incomplete, and update what is stale. On a request to erase, it must erase — unless retention is needed for the specified purpose or by law.§ 12(2)–(3)
13Right of grievance redressalReadily available means of redress from the Data Fiduciary or Consent Manager for any act or omission about your personal data or the exercise of your rights. They must respond within the prescribed period.You must exhaust this route before approaching the Board. § 13(3)
14Right to nominateNominate another individual to exercise your rights in the event of death or incapacity — incapacity meaning inability to act due to unsoundness of mind or infirmity of body.§ 14(1)–(2)
Section 15 — the five duties
Duties are enforceable: breach of them is the one penalty head in the Schedule measured in thousands, not crores — up to ₹10,000.
Comply with all applicable laws while exercising your rights. § 15(a)
Do not impersonate another person when providing personal data. § 15(b)
Do not suppress material information when applying for a State-issued document, identifier or proof of identity or address. § 15(c)
Do not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board. § 15(d)
Furnish only verifiably authentic information when exercising correction or erasure. § 15(e)
Escalation orderData Fiduciary or Consent Manager → the Board → the Appellate Tribunal within 60 days → appeal under the TRAI ActNo civil court may entertain a matter the Board is empowered to decide, and no injunction may be granted against action taken under the Act. §§ 13, 27–29, 39
Four rights, five duties, one exam.Fifteen questions, twenty minutes, certificate the same minute you pass.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 2 August 2026 against the DPDP Act, 2023 and notified DPDP Rules, 2025. Educational information, not legal advice.