Lesson 1
The right to access information about personal data
Chapter III of the Digital Personal Data Protection Act, 2023, which runs from Section 11 to Section 15, is written from the point of view of the Data Principal: the individual the personal data is about. It gives her four rights (access, correction and erasure, grievance redressal, and nomination) and places five duties on her in return. None of Chapter III is in force yet. Under the commencement notification G.S.R. 843(E), Sections 11 to 15 commence on 13 May 2027, eighteen months after the DPDP Rules, 2025 were published on 13 November 2025. Until then, these provisions describe what Data Fiduciaries need to be ready for.
Section 11 is the right to access information. A Data Principal can require a Data Fiduciary to give her a summary of the personal data it is processing about her and of the processing activities it carries out on that data. She can also require the identities of every other Data Fiduciary and every Data Processor with whom her data has been shared, together with a description of the data that was shared. Finally, she can ask for any other information that is prescribed under the Rules.
The right does not run against every organisation in the abstract. It runs against a Data Fiduciary to whom she has previously given consent for processing, and that includes processing on the Section 7(a) ground, where she voluntarily provided the data for a specific purpose. The access right attaches to that relationship.
There is one mandatory carve-out. A Data Fiduciary does not have to disclose sharing with another Data Fiduciary that is legally authorised to obtain the data, such as sharing made in response to a written request for the prevention, detection, investigation or prosecution of an offence or a cyber incident. Such sharing is left out of the access response. All other sharing, including sharing with Data Processors, has to be disclosed.
In practice, a Data Fiduciary can only answer an access request if it tracks where personal data goes. Rule 14 of the DPDP Rules, 2025 sets the timeframe for responding once it is in force. Under Section 17(3) the Central Government can exempt notified Data Fiduciaries or classes of them, including startups, from Section 11, but only by notification; nobody can declare themselves exempt. No item in the Schedule names Section 11, so failing to honour an access request falls under the residual item 7, with a penalty of up to ₹50 crore on the Data Fiduciary.
- Chapter III (Sections 11 to 15) commences on 13 May 2027 and is not yet in force.
- A Data Principal can obtain a summary of her personal data and the processing done on it, plus the identities of every Data Fiduciary and Data Processor it was shared with and what was shared.
- The right runs against a Data Fiduciary she gave consent to, including on the Section 7(a) voluntary-data ground.
- Sharing with a Data Fiduciary legally authorised to obtain the data, such as on a written law-enforcement or cyber-incident request, is excluded from the response.
- Refusing a valid access request falls under the Schedule's residual item 7, up to ₹50 crore.
Lesson 2
The right to correction, completion, updating and erasure
Section 12 gives a Data Principal the right to correction, completion, updating and erasure of her personal data. Like the access right, it applies to personal data processed on her consent, including data she voluntarily provided under Section 7(a). It is also subject to any procedure that another applicable law sets for the data in question.
When she asks for correction, completion or updating, the Data Fiduciary must act on the record itself. It must correct personal data that is inaccurate or misleading, complete data that is incomplete, and update it. Logging the request is not enough. Rule 14 of the DPDP Rules, 2025 prescribes the manner in which these requests are made once it is in force.
When she asks for erasure, the Data Fiduciary must erase the data unless keeping it is necessary for the specified purpose or for compliance with law. These are the only two reasons to keep the data. A Data Fiduciary that refuses an erasure request should be able to show which of the two applies if the refusal is challenged.
Section 12 works alongside the Data Fiduciary's general obligations in Section 8. Section 8(3) already requires personal data to be complete, accurate and consistent wherever it will be used to make a decision about the Data Principal or disclosed to another Data Fiduciary. Section 8(7) requires erasure once she withdraws consent or the purpose is no longer being served, whichever is earlier, unless another law requires retention, and the Data Fiduciary must have its Data Processors erase the data too. Erasure can therefore follow from her request or from the Data Fiduciary's own retention duty.
The right has limits, and so does the person using it. Under Section 17(4), State processing that does not feed a decision about a specific Data Principal is exempt from the correction and erasure duties in Section 12. Under Section 15, a Data Principal seeking correction or erasure must furnish only information that is verifiably authentic. Refusing a valid request without a lawful basis falls under the Schedule's residual item 7, up to ₹50 crore. Section 12 commences on 13 May 2027.
- Section 12 covers four actions: correction, completion, updating and erasure.
- Inaccurate or misleading data must be corrected, incomplete data completed, and the record updated.
- Erasure may be refused only where retention is necessary for the specified purpose or for compliance with law.
- Section 8(7) separately requires erasure once consent is withdrawn or the purpose ends, unless another law requires retention.
- A Data Principal using these rights must give only verifiably authentic information (Section 15).
Lesson 3
The right to grievance redressal
Section 13 gives a Data Principal the right to readily available grievance redressal. She can raise a grievance with a Data Fiduciary or a Consent Manager about anything it did, or failed to do, in relation to her personal data or her rights under the Act. The standard is that redressal must be readily available. A channel that exists somewhere in a privacy policy but is hard to find or use does not meet it.
The Data Fiduciary or Consent Manager must respond to the grievance within a prescribed period. The Act itself does not fix a number of days. It leaves the period to be prescribed, and Rule 14 of the DPDP Rules, 2025 sets it. A Data Fiduciary should publish the response period it works to alongside its grievance channel, so that Data Principals know what to expect.
The grievance channel is the mandatory first step. A Data Principal must exhaust the grievance redressal available from the Data Fiduciary or Consent Manager before she can take the matter to the Data Protection Board. For a Data Fiduciary, its own grievance process is therefore the first line of response to a complaint, and it is worth running it properly.
Several other provisions support this right. Section 8(10) requires every Data Fiduciary to run an effective grievance redressal mechanism, and Section 8(9) requires it to publish the business contact information of a Data Protection Officer or another person who can answer questions about its processing. The notice under Section 5 must tell the Data Principal how to exercise her Section 13 rights and how to complain to the Board, and Rule 3 requires the notice to give the actual link for doing so. Where the Data Fiduciary is a Significant Data Fiduciary, Section 10 makes its Data Protection Officer the point of contact for grievance redressal.
No Schedule item names Section 13, so an ineffective or unresponsive grievance mechanism falls under the residual item 7, with a penalty of up to ₹50 crore. The Data Principal's duties apply here as well. Section 15 bars her from registering a false or frivolous grievance with a Data Fiduciary or the Board. Section 13 commences on 13 May 2027.
- A Data Principal can seek readily available grievance redressal from a Data Fiduciary or a Consent Manager.
- The response period is prescribed by Rule 14 of the DPDP Rules, 2025; the Act does not fix it in days.
- She must exhaust this grievance channel before she can complain to the Board.
- Section 8(10) requires an effective grievance mechanism, and a Significant Data Fiduciary's Data Protection Officer is its grievance contact.
- A false or frivolous grievance is a breach of the Data Principal's own duty under Section 15.
Lesson 4
Rights exercised by others: nominees, parents and lawful guardians
Section 14 lets a Data Principal nominate another individual to exercise her rights under the Act if she dies or becomes incapacitated. Incapacity here means being unable to exercise her rights because of unsoundness of mind or physical infirmity. The nominee must be an individual, and the nomination is made in the manner Rule 14 of the DPDP Rules, 2025 prescribes once it is in force.
For a Data Fiduciary, the duty is to recognise the nomination. Once the Data Principal's death or incapacity is established, the nominee can exercise her rights, and the Data Fiduciary should not treat her account as simply closed to everyone. No Schedule item names Section 14, so refusing to honour a valid nomination falls under the residual item 7, up to ₹50 crore.
Children and persons with disability are covered differently, through the definitions in Section 2. Where the individual is a child, meaning anyone under 18, the term Data Principal includes her parent or lawful guardian. Where she is a person with disability, it includes her lawful guardian. Because the parent or guardian falls within the definition of Data Principal, the Chapter III rights, such as access, correction and erasure, and grievance redressal, are exercised through them on her behalf.
Section 9 adds protections for these groups. Before processing the personal data of a child, or of a person with disability who has a lawful guardian, a Data Fiduciary must obtain verifiable consent from the parent or that lawful guardian, using the mechanisms in Rule 10. Two things are prohibited even with that consent: processing likely to have a detrimental effect on a child's well-being, and tracking, behavioural monitoring or targeted advertising directed at children. A breach of Section 9 carries a penalty of up to ₹200 crore under item 3 of the Schedule.
The exemptions are narrow. Rule 12 exempts specified classes, such as clinical establishments, schools, crèches and school-transport operators, for processing tied to health, safety or education, and specified purposes such as age-gating and real-time location for safety. The Central Government can also notify an age above which a particular Data Fiduciary is exempt, but only by naming it, so this is not a general safe harbour. Sections 9 and 14 both commence on 13 May 2027.
- A Data Principal can nominate an individual to exercise her rights if she dies or becomes incapacitated.
- Incapacity means inability to exercise rights because of unsoundness of mind or physical infirmity.
- For a child (under 18), the Data Principal includes the parent or lawful guardian; for a person with disability, the lawful guardian.
- Processing such data needs verifiable consent from the parent or lawful guardian, and tracking or targeted advertising directed at children is barred even with consent.
- A breach of Section 9 carries a penalty of up to ₹200 crore.
Lesson 5
Duties of Data Principals and the penalty for breach
Section 15 is the one provision in Chapter III that places obligations on the individual rather than on the organisation. A Data Principal exercising her rights has five duties: to comply with applicable law while doing so; not to impersonate another person while providing her personal data for a specified purpose; not to suppress any material information while providing her personal data for a State-issued document, identifier, proof of identity or proof of address; not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and to furnish only information that is verifiably authentic when exercising her right to correction or erasure.
The duties match the rights. Correction and erasure depend on the information she supplies being genuine. Grievance redressal and the complaint process depend on complaints being made in good faith. Identity documents depend on her not hiding material facts. The duties are meant to keep the rights from being misused.
Item 5 of the Schedule to Section 33 sets the penalty for a Data Principal who breaches these duties at up to ₹10,000. It is the only item in the Schedule that penalises the Data Principal rather than a Data Fiduciary or other organisation, and the amount is far below the crore-level figures that apply to Data Fiduciaries. As with every penalty under the Act, it is monetary and is imposed by the Board after an inquiry and a hearing. The Act does not create a criminal offence of its own.
The Board has a related power under Section 28. If it finds that a complaint was false or frivolous, it can issue a warning or impose costs on the complainant. This is in addition to any penalty for breaching a Section 15 duty.
A breach by the Data Principal does not release the Data Fiduciary. Section 8(1) makes the Data Fiduciary responsible for complying with the Act whether or not the Data Principal has kept to her duties under Section 15. Section 15 commences on 13 May 2027, with the rest of Chapter III.
- Section 15 places five duties on the Data Principal herself.
- She must not impersonate anyone, suppress material information for State-issued documents, or file false or frivolous complaints.
- When seeking correction or erasure, she must provide only verifiably authentic information.
- Breaching these duties carries a penalty of up to ₹10,000, the only Schedule item that falls on the Data Principal.
- A Data Principal's breach does not relieve the Data Fiduciary of its own compliance duty under Section 8(1).
Lesson 6
Exercising rights in practice: the Data Fiduciary, Consent Managers and the Board
In practice a Data Principal has three routes for exercising her rights: the Data Fiduciary, a Consent Manager, and the Data Protection Board. The first is the Data Fiduciary. The notice it gives under Section 5, before or together with the request for consent, must tell her how to withdraw consent under Section 6(4), how to exercise her Section 13 rights and how to complain to the Board. Rule 3 requires the notice to include the actual link to the website or app where she can do these things. Every consent request must also give the contact details of a Data Protection Officer, where one is required, or another authorised contact person. Section 8(9) requires those contact details to be published on the Data Fiduciary's website or app.
The second is a Consent Manager, through which a Data Principal can give, manage, review and withdraw her consent across Data Fiduciaries. A Consent Manager is accountable to the Data Principal. Every Consent Manager must be registered with the Board, and that requirement in Section 6(9) commences on 13 November 2026, earlier than most of the Act. A Consent Manager must also provide grievance redressal under Section 13, and a Data Principal can complain to the Board about one.
Withdrawing consent works the same way whichever route she uses. It must be as easy as giving consent was. After withdrawal, the Data Fiduciary and any Data Processor acting for it must stop processing within a reasonable time, unless another lawful basis allows it to continue. Processing that took place before the withdrawal remains lawful. Consent cannot be used to give up her statutory rights either: any part of a consent that would waive her right to complain to the Board is invalid to that extent.
The third route is the Board. Once she has exhausted the grievance redressal channel, she can complain to the Board about a personal data breach, about a Data Fiduciary failing to meet its obligations or honour her rights, or about a Consent Manager. The Board works as a digital office as far as practicable. It first decides whether there are sufficient grounds to proceed, and can close the matter with recorded reasons if there are not. If there are, it inquires in line with natural justice, using a civil court's powers to summon witnesses and inspect documents, and can impose a penalty under Section 33. It can also direct the parties to mediation. The provisions establishing the Board have been in force since 13 November 2025, but its powers to act on complaints under Sections 27 and 28 commence on 13 May 2027.
A Data Principal or Data Fiduciary aggrieved by a Board order can appeal to the Appellate Tribunal, the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), within 60 days of receiving the order. The Tribunal can admit a late appeal if there was sufficient cause and aims to decide appeals within six months. Civil courts have no jurisdiction over matters the Board is empowered to deal with, so the route is the Data Fiduciary or Consent Manager first, then the Board, then the Tribunal.
- The Section 5 notice must explain how to withdraw consent, exercise Section 13 rights and complain to the Board, with a working link under Rule 3.
- A Consent Manager is accountable to the Data Principal; its registration requirement commences on 13 November 2026.
- Withdrawal must be as easy as giving consent, and consent cannot waive the right to complain to the Board.
- After exhausting grievance redressal, a Data Principal can complain to the Board, which operates as a digital office.
- Board orders are appealed to TDSAT within 60 days; civil courts have no jurisdiction over matters the Board handles.
Section 5Section 6Section 8Section 13Section 27Section 28Section 29Section 31Section 39
Check yourself
5 random questions from this module. Answers are marked straight away and don't count toward the exam.