Rights and Duties of Data Principals Under the DPDP Act
· Sri Tulasi Tech Labs
The DPDP Act gives individuals — Data Principals — clear rights over their personal data, and places a few duties on them in return. Organisations need a reliable process to handle requests within the time the Rules allow.
The rights
1. Right to access information
A Data Principal who gave consent (or whose data is processed for a voluntary-provision legitimate use) can obtain a summary of the personal data being processed and the processing activities, the identities of other Data Fiduciaries and Processors with whom it has been shared, and other information the Rules prescribe.
2. Right to correction, completion, updating and erasure
Data Principals can ask for inaccurate or misleading data to be corrected, incomplete data to be completed, and data to be updated. They can also ask for erasure — the organisation must erase the data unless retention is necessary for the specified purpose or to comply with law.
3. Right to grievance redressal
Organisations must provide a readily available way to raise grievances and respond within the period prescribed. A Data Principal must exhaust this route before approaching the Data Protection Board.
4. Right to nominate
A Data Principal can nominate another individual to exercise their rights in the event of death or incapacity.
The duties of Data Principals
- Comply with applicable laws when exercising rights.
- Not impersonate another person when providing personal data.
- Not suppress material information when providing data for official documents.
- Not register false or frivolous grievances or complaints.
- Provide only verifiably authentic information when seeking correction or erasure.
Breaching these duties can attract a penalty of up to ₹10,000.
How organisations should prepare
- Publish how to make a request — a web form or email address in your privacy notice.
- Verify the requester’s identity before acting.
- Know where each person’s data sits, including with your processors.
- Track every request to closure within the prescribed timelines.
- Keep a record of requests and responses.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.