/FAQ
Rights of individuals
Access, correction, erasure, grievance redressal and nomination, how to exercise each right under rule 14, plus the duties the Act places on individuals.
What rights do I have over my personal data?
Four, set out in Chapter III. The right to obtain information about the personal data being processed about you and who it has been shared with (section 11). The right to correction, completion, updating and erasure (section 12). The right to readily available grievance redressal from the Data Fiduciary or Consent Manager (section 13). And the right to nominate someone to exercise your rights if you die or become incapacitated (section 14). The first two run against a Data Fiduciary to whom you have previously given consent, "including consent as referred to in clause (a) of section 7", which is data you voluntarily provided for a specified purpose.
How do I ask a company for a copy of the data it holds about me?
You make a request in the manner that company has published. The Data Fiduciary, and where relevant the Consent Manager, must prominently publish on its website or app the details of the means for making a request and the particulars, such as a username or other identifier, needed to identify you under its terms of service (rule 14(1)). You then use those means and furnish those particulars (rule 14(2)). What you are entitled to receive is a summary of the personal data being processed and the processing activities, the identities of every other Data Fiduciary and Data Processor the data has been shared with along with a description of what was shared, and anything else that may be prescribed (section 11(1)).
Is there anything a company can hold back from an access request?
One category. The duty to disclose who your data was shared with does not apply where the sharing was with another Data Fiduciary authorised by law to obtain that personal data, pursuant to a written request, for the prevention, detection or investigation of offences or cyber incidents, or for the prosecution or punishment of offences (section 11(2)). The summary of your own data under clause (a) is not carved out. Neither the Act nor the Rules fix a deadline for answering an access request; the only response period the Rules prescribe is for grievances.
Can I get my personal data corrected or erased?
Yes, and the two work differently. On a correction request the Data Fiduciary must correct inaccurate or misleading personal data, complete incomplete personal data, and update personal data (section 12(2)). On an erasure request made in the prescribed manner, it must erase your personal data "unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force" (section 12(3)). Erasure also happens without you asking: once you withdraw consent, or once the specified purpose is no longer being served, the Data Fiduciary must erase the data and make its Data Processor do the same (section 8(7)).
How long does a company have to respond to my complaint?
Ninety days at the outside. The Act says a Data Fiduciary or Consent Manager must respond to grievances "within such period as may be prescribed" from the date of receipt (section 13(2)). The Rules fix that as "a reasonable period not exceeding ninety days", and require the organisation to implement appropriate technical and organisational measures so its grievance system actually responds within that period (rule 14(3)). As printed in the gazette, sub-rule (3) reads awkwardly, but the outer limit it sets is ninety days. Every Data Fiduciary must also establish an effective grievance redressal mechanism (section 8(10)), and you must exhaust it before approaching the Board (section 13(3)).
Can I nominate someone to exercise my rights if I die?
Yes. You have the right to nominate, in the prescribed manner, another individual who will exercise your rights in the event of your death or incapacity (section 14(1)). "Incapacity" is defined as inability to exercise those rights due to unsoundness of mind or infirmity of body (section 14(2)). The Rules allow you to nominate "one or more individuals", in accordance with the Data Fiduciary's terms of service and applicable law, using the means and particulars it requires (rule 14(4)).
Who do I contact at a company about how my data is used?
The Data Protection Officer, if the company has one, or whoever it names instead. A Data Fiduciary must publish the business contact information of its Data Protection Officer, if applicable, or of a person able to answer questions about the processing of personal data on its behalf (section 8(9)). The Rules say where: prominently on its website or app, and in every response to a communication for the exercise of a Data Principal's rights (rule 9). A Data Protection Officer is compulsory only for a Significant Data Fiduciary (section 10(2)).
What duties do I have as a Data Principal?
Five, and one of them has teeth. You must comply with all applicable laws while exercising your rights; not impersonate another person while providing personal data for a specified purpose; not suppress material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State; not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and furnish only verifiably authentic information when exercising the right to correction or erasure (section 15).
What happens if I file a false or frivolous complaint?
Two consequences are possible. A breach in observance of the duties under section 15 carries a penalty that "may extend to ten thousand rupees" (the Schedule), the only penalty in the Act aimed at individuals rather than organisations. Separately, at any stage after receiving a complaint, if the Board is of the opinion that the complaint is false or frivolous, it "may issue a warning or impose costs on the complainant" (section 28(12)).
Are these rights available today?
Not yet. Sections 11 to 17 come into force eighteen months after publication of G.S.R. 843(E), that is on 13 May 2027, and section 8, which carries the grievance mechanism and the contact publication duty, commences on the same date. Rule 9 and rule 14 fall in the group brought into force eighteen months after publication of the Rules (rule 1(4)). Until then a company may of course offer these routes voluntarily, but the Act does not yet compel them.
/MYND · DPDP practice
Have a question about your own situation?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.