Four Rights You Can Exercise, Five Duties You Owe

Rights run against the Data Fiduciary you gave consent to - including consent treated as given under section 7(a). Requests are made in the prescribed manner, and grievances go to the Fiduciary before the Board.

11Right to access information about personal dataOn request, obtain a summary of the personal data being processed and the processing activities carried out, the identities of every other Data Fiduciary and Data Processor the data was shared with, and a description of what was shared.Limit: the sharing disclosure does not apply where data was shared with another Fiduciary authorised by law for prevention, detection or investigation of offences or cyber incidents. § 11(2)

12Right to correction and erasureOn a request to correct, complete or update, the Data Fiduciary must correct inaccurate or misleading data, complete what is incomplete, and update what is stale. On a request to erase, it must erase - unless retention is needed for the specified purpose or by law.§ 12(2)–(3)

13Right of grievance redressalReadily available means of redress from the Data Fiduciary or Consent Manager for any act or omission about your personal data or the exercise of your rights. They must respond within the prescribed period.You must exhaust this route before approaching the Board. § 13(3)

14Right to nominateNominate another individual to exercise your rights in the event of death or incapacity - incapacity meaning inability to act due to unsoundness of mind or infirmity of body.§ 14(1)–(2)

Section 15 - the five duties

Duties are enforceable: breach of them is the one penalty head in the Schedule measured in thousands, not crores - up to ₹10,000.

Comply with all applicable laws while exercising your rights. § 15(a)

Do not impersonate another person when providing personal data. § 15(b)

Do not suppress material information when applying for a State-issued document, identifier or proof of identity or address. § 15(c)

Do not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board. § 15(d)

Furnish only verifiably authentic information when exercising correction or erasure. § 15(e)

Escalation orderData Fiduciary or Consent Manager → the Board → the Appellate Tribunal within 60 days → appeal under the TRAI ActNo civil court may entertain a matter the Board is empowered to decide, and no injunction may be granted against action taken under the Act. §§ 13, 27–29, 39

Four rights, five duties, one exam.Fifteen questions, twenty minutes, certificate the same minute you pass.

Take the exam Next: Obligations

Handling these rights in practice

A practical Data Principal request workflowAccess, correction, erasure, grievance redressal and nomination without operational dead ends.Children's data under the DPDP Act and RulesVerifiable parental consent, age assurance and the notified exemptions.DPDP compliance templates and request resourcesThe request workflow, evidence fields and related implementation files in one library.DPDP readiness checklistTest whether rights channels, identity checks, processor routing and grievance evidence are in place.

Rule 14 · Rule 9

What makes a right exercisable

A right nobody can find is not much of a right. The Rules turn sections 11 to 14 into published means, a named identifier, a response deadline and a contact that travels with every answer.

Rule 14(1)Publish the means, and the identifier you needThe Data Fiduciary - and the Consent Manager where applicable - must prominently publish, on its website or app or both, the means by which a request can be made, and the particulars such as a username or other identifier it needs in order to identify her under its terms of service.Both halves matter. A contact form with no statement of what identifies the requester puts the burden back on her, which is the opposite of what the rule asks.

Rule 14(3)Ninety days, and it is a ceilingSection 13(2) required a response to grievances within “such period as may be prescribed”. The Rules fix it: a reasonable period not exceeding ninety days, published prominently, with appropriate technical and organisational measures implemented to make the system actually respond within it.Ninety days is the outer limit, not a target. The rule asks for a reasonable period and then caps it - publishing “90 days” while routinely taking 89 is not obviously compliance with the first half.

Rule 9The contact has to travel with the answerPublish the business contact information of the Data Protection Officer, if applicable, or of a person who can answer questions about the processing - and repeat it in every response to a communication exercising a right.The second limb is easy to miss in an automated reply. It is a template change, not a policy change.

Rule 14(4)Nomination can be more than one personShe may nominate one or more individuals, in accordance with the Fiduciary's terms of service and applicable law, using the means and particulars it requires.So a nomination field is not a single optional text box. It is a list, and it has to survive the death or incapacity it exists for.

The fine print

Four limits worth knowing before you build

Each of these changes how a request is handled, and none of them is obvious from the section headings alone.

§ 11(2)The sharing disclosure has a carve-outThe right to learn who your data was shared with does not apply where it was shared with another Data Fiduciary authorised by law to obtain it, in connection with the prevention, detection or investigation of offences or cyber incidents, or prosecution or punishment.So an access response can be complete and still not list every recipient. The gap is lawful, and it is worth knowing before you assume a disclosure was incomplete.

§ 12(3)Erasure yields to a retention obligationOn a request the Data Fiduciary must erase - unless retention is necessary for the specified purpose or for compliance with any law in force.The second limb is why a deletion request does not empty a ledger a tax statute requires you to keep.

§ 13(3)She must come to you firstThe Data Principal shall exhaust the opportunity of redressing her grievance under section 13 before approaching the Board.A working grievance mechanism is therefore a genuine filter on regulatory exposure, not just a compliance artefact - every complaint it resolves is one that never reaches section 27(1)(b).

§ 15Rights come with enforceable dutiesFive duties sit on the Data Principal: comply with applicable law when exercising rights, do not impersonate, do not suppress material information for a State-issued document, do not register a false or frivolous grievance, and furnish only verifiably authentic information when seeking correction or erasure.Breach of these is a penalty head in the Schedule, capped at ₹10,000. GDPR has no equivalent - it places no obligations on the data subject at all.

DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against the DPDP Act, 2023 and notified DPDP Rules, 2025. Educational information, not legal advice.

Review standards and attribution →