DPDP Act, 2023: rights and duties of data principals
- Use this page to tighten dpdp act, 2023: rights and duties of data principals with owners and dates.
- Connect narrative to systems: where data lives, who can export it, what breaks on delete.
- Add evidence habits (logs, tickets) so audits do not rely on memory.
- Bookmark official resources for statutory text; stay skeptical of unattributed claims.
- Use the compliance portal to chain the next guide when this section is done.
See also: Compliance portal · Official resources · Guides index
This cluster is where the law meets tickets. Data principals—the individuals the data is about—have a structured set of rights that must become routing rules, SLAs, identity checks, and completion records. Principal-side duties also matter when requests are abusive or when accuracy depends on user input.
If your organization cannot explain, in one internal page,
how each right is requested, validated, fulfilled, and
logged, you are not yet “rights-ready”; you are hoping for low
volume.
Related operations
Request-handling guides and checklists aligned with principal-side rights.
Rights at a glance (operational framing)
- Access and transparency about processing (Section 11) — Principals need a credible path to a summary of the personal data processed and the identities of other fiduciaries/processors it was shared with; your CRM exports and admin tooling must match the story your notice tells.
- Correction, completion, updating, and erasure (Section 12) — Workflows for structured profile data and messy human records (support notes, onboarding emails) need owners. Erasure requests follow Section 12(3); Rule 8(2) requires giving the Principal 48 hours’ notice before scheduled erasure actually runs.
- Grievance redressal (Section 13) — A visible escalation path, published under Rule 14(3), that responds within a reasonable period not exceeding 90 days and does not become a black hole; the Principal must use it before going to the Board.
- Nomination (Section 14) — Less common in day-one implementation, but high impact when needed: it activates on the Principal’s death or incapacity (defined as unsoundness of mind or infirmity of body), so define how you verify authority without creating new security risks.
What to do next (program steps)
- Single intake — One form or email path with clear categories (access / correction / deletion / other). Avoid scattered inboxes.
- Triage rules — Which systems are searched first, who approves unusual exports, and when legal must be in the loop.
- Identity proportionality — Use checks that match risk; document the standard so agents do not improvise under pressure.
- Completion and appeals literacy — Train frontline teams on closure wording and where principals can escalate under the Act’s framework.
- Fiduciary linkage — Rights responses depend on accurate upstream processing; pair this cluster with the fiduciary obligations spine.
Related statute spine on this site
- Fiduciary obligations cluster — where notice, consent, and processing quality originate.
- Board, appeals, penalties cluster — when complaints escalate beyond your grievance channel.
- DPDP for enterprises — operating rights programs across many BUs and tools.
Further reading (primary and hub)
- Digital Personal Data Protection Act, 2023 — India Code (authoritative text)
- Rules & regulatory updates
- Full Act chapter map
- Compliance portal
- Templates and worksheets