# DPDP data principal rights: access, erasure, grievances and nomination

Source: https://dpdp.d2c.in/guides/dpdp-data-principal-rights/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs

**Short answer:** Sections 11 to 14 of the DPDP Act give people the right to access a summary of their data, to correct, complete, update and erase it, to grievance redressal, and to nominate someone to act for them. From 13 May 2027, Rule 14 requires you to publish how to make requests and your grievance response period, which cannot exceed 90 days.

## Key takeaways

- Rights cover access (s.11), correction, completion, updating and erasure (s.12), grievance redressal (s.13) and nomination (s.14).
- Rule 14 requires you to publish the means to make requests and the identifiers needed to verify the person.
- The 90-day maximum in Rule 14(3) applies to grievances; set and publish your own service levels for other requests.
- People must use your grievance process before they can complain to the Data Protection Board.
- Data Principals have duties too under section 15, with a penalty of up to ₹10,000 for breaching them.

Rights requests are where your data map gets tested by someone outside the company. A customer asks what you hold about her, or asks you to delete it, and your team has to find every copy across the app database, the CRM, the support desk, the warehouse and each vendor. Without a workflow, that becomes a manual hunt each time.

This guide sets out each right under the DPDP Act, what you must publish under Rule 14, how to verify identity, how processors fit, and how to build a request workflow. Sections 11 to 15 of the Act and Rule 14 apply from 13 May 2027.

## What rights does a Data Principal have under DPDP?

A Data Principal is the person the data is about, and includes the parent or lawful guardian of a child and the lawful guardian of a person with disability (section 2(j)). The Act gives her the following rights.

| Right | Section | What the person can ask | What you must do | Exceptions and limits |
|---|---|---|---|---|
| Access | s.11 | A summary of her personal data and the processing; the identities of other fiduciaries and processors you shared it with, and a description of what was shared | Pull data from every system and processor, produce a clear summary, list recipients | Only against a fiduciary she gave consent to, including under s.7(a). Recipients need not be listed where data went to a fiduciary authorised by law, on its written request, to prevent, detect or investigate offences or cyber incidents (s.11(2)). Exemptions in s.17(1), such as investigation of offences or enforcing legal rights |
| Correction, completion, updating | s.12 | Fix inaccurate or misleading data, complete what is incomplete, update what has changed | Verify the change, apply it in every system and at processors | s.17(1) exemptions; you can ask for evidence where the change matters |
| Erasure | s.12, s.8(7) | Erase personal data | Erase it and make processors erase it | Retention still necessary for the specified purpose or required by law (s.12(3)); one-year retention of data and logs under Rule 8(3) |
| Withdraw consent | s.6(4) | Stop processing based on her consent | Stop within a reasonable time, make processors stop, then erase | Past processing stays lawful (s.6(5)); does not apply to section 7 legitimate uses |
| Grievance redressal | s.13 | Raise a complaint about how you handled her data or a request | Respond within your published period, not exceeding 90 days (Rule 14(3)) | Must be used before she can approach the Board |
| Nomination | s.14 | Nominate another individual to exercise her rights if she dies or becomes incapable | Record the nomination, verify the nominee when they act | Nominee acts only on the trigger event |

Section 17 exemptions are narrow and specific. Do not use them as a general reason to refuse; record the exemption relied on and why, for each refused request.

## What must you publish under Rule 14?

Rule 14 turns the rights into publishing duties. Prominently on your website or app, you must publish:

- **The means to make a request** (Rule 14(1)(a)): a web form, an in-app screen, an email address. Keep it findable from the notice and the privacy policy.

- **The identifiers you need** (Rule 14(1)(b)): the username or other identifier required to identify the person under your terms of service, such as a registered mobile number or customer ID.

- **Your grievance response period** (Rule 14(3)): a reasonable period, not exceeding 90 days, with technical and organisational measures to make sure you meet it.

Rule 9 adds one more: publish the business contact of your Data Protection Officer, if you have one, or of a person who can answer questions about processing, and include that contact in every response to a rights request.

- **90 days** maximum grievance response period you can publish
- **6** rights and routes to support, including withdrawal
- **₹10,000** maximum penalty for breaching a Data Principal duty
Be precise about the 90 daysThe 90-day cap in Rule 14(3) is for responding to grievances. It is not a deadline the Rules set for access, correction or erasure requests. Set your own service levels for those, publish them, and keep them well inside 90 days so a delayed request does not turn into a grievance.

### Do you need a DPDP grievance officer?

Section 8(10) requires every fiduciary to have an effective mechanism to redress grievances. The Act does not require every company to appoint someone with the title “grievance officer”. What it does require, through section 8(9) and Rule 9, is a published business contact: your DPO if you are a [Significant Data Fiduciary](https://dpdp.d2c.in/guides/significant-data-fiduciary/) (whose DPO is the grievance contact), or otherwise a person who can answer questions about processing.

In practice, name an owner for grievances, give them authority to get answers from engineering and vendors, and track every grievance to closure with a date. Consent managers, once registered, must run their own grievance process too.

## How do you verify identity without collecting more data?

Verify before you act. Sending a full data summary to the wrong person is itself a [personal data breach](https://dpdp.d2c.in/guides/dpdp-breach-notification/). But verification should not become a reason to collect identity documents you never needed.

- **Match to what you hold.** Use the identifiers you published under Rule 14(1)(b): a one-time code to the registered mobile or email, or a request made from inside a logged-in account.

- **Step up for higher risk.** Access and erasure of sensitive data justify a second factor. A marketing opt-out does not.

- **Verify representatives.** For a parent or guardian, follow the same checks you use for [verifiable parental consent](https://dpdp.d2c.in/guides/dpdp-children-data/). For a nominee, check the nomination record and evidence of death or incapacity.

- **Do not keep verification artefacts longer than needed.** Record that verification passed and how, not copies of documents.

## Who answers: the fiduciary or the processor?

Rights are exercised against the Data Fiduciary. Section 8(1) keeps the fiduciary responsible for processing done on its behalf by processors. If you are a processor, for example a SaaS platform holding your customers' end-user data, requests that reach you belong to your customer.

If you are the fiduciary

- Receive, verify and decide on the request

- Fulfil it in your systems and instruct each processor

- Collect confirmations from processors

- Respond to the person with your Rule 9 contact

- Own the grievance if she is unhappy
If you are the processor

- Do not decide the request yourself

- Forward it to the right customer quickly

- Give customers tools to search, export, correct and erase

- Act on the customer's instruction, then confirm

- Write these duties into your contracts
Our guide to [fiduciaries and processors](https://dpdp.d2c.in/guides/data-fiduciary-vs-data-processor/) covers how to tell which role you hold for each data set. Many companies hold both.

## How do erasure and retention fit together?

An erasure request does not override a law that requires you to keep data. Tax, company and sector rules often do. Rule 8(3) also requires every fiduciary to keep personal data, associated traffic data and processing logs for at least one year from processing. So an erasure response often has two parts: what you deleted now, and what you must keep, why, and when it will be erased. Say so plainly in your reply. Our [data retention guide](https://dpdp.d2c.in/guides/dpdp-data-retention/) covers the full schedule.

## What duties do Data Principals have?

Section 15 places duties on the people exercising rights. A Data Principal must not impersonate another person, must not suppress material information when providing data for a State-issued document, identifier or proof of identity or address, must not register a false or frivolous grievance or complaint, must give only verifiably authentic information when seeking correction or erasure, and must comply with applicable laws while exercising rights. Breaching these duties can attract a penalty of up to ₹10,000.

For your team, section 15 is a reason to keep good records, not a reason to push back on requests. If you think a request is fraudulent, verify harder and document it.

## When can someone complain to the Data Protection Board?

Only after exhausting your grievance redressal. Section 13 requires the person to use the grievance mechanism of the fiduciary or consent manager first. After that, she can complain to the Board. Board inquiries are to be completed within six months, extendable by three months at a time (Rule 19). Appeals against Board orders go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (section 29).

The Board has been established, but as of November 2026 its Chairperson and Members have not been appointed. That does not change your timeline: Rule 14 and the rights sections apply from 13 May 2027, and your grievance records are likely to be among the first things the Board asks for.

## How to build a rights request workflow

- **Publish the channels.** One rights page with a form and an in-app route, linked from your notices, with the Rule 14 identifiers and grievance period.

- **Log every request.** Ticket per request: type, date received, verification result, systems searched, outcome, response date.

- **Map systems to rights.** From your data inventory, list for each system how to export, correct and erase a person's data, and who does it.

- **Automate the common paths.** Self-service access export and marketing opt-out typically cover much of the volume.

- **Instruct processors.** A standard instruction and confirmation for each vendor holding the data.

- **Template the replies.** Include the Rule 9 contact, what was done, what was retained and why, and how to raise a grievance.

- **Report monthly.** Volumes, ageing against service levels, refusals and the exemption relied on.

The rights workflow is a core item in the [DPDP compliance checklist](https://dpdp.d2c.in/guides/dpdp-compliance-checklist/). If you want us to build the intake, routing and fulfilment across your systems, see [our services](https://dpdp.d2c.in/#services).

## Frequently asked questions

### What are the rights of a Data Principal under the DPDP Act?

The right to access information about personal data (s.11); to correction, completion, updating and erasure (s.12); to grievance redressal (s.13); and to nominate another person to exercise rights in the event of death or incapacity (s.14). People can also withdraw consent at any time under section 6(4).

### Is there a right to erasure under DPDP?

Yes. Section 12 gives a right to erasure, and section 8(7) requires you to erase data when consent is withdrawn or the purpose is no longer served, and to make your processors erase it too. You can keep data where retention is still necessary for the specified purpose or required by law (s.12(3), s.8(7)), and Rule 8(3) requires processing logs and associated data to be kept for at least one year.

### How long does a company have to respond to a DPDP grievance?

Rule 14(3) requires every fiduciary to publish its grievance response period, which must be a reasonable period not exceeding 90 days. The 90-day cap applies to grievances. For other rights requests, set and publish your own service levels.

### Do I need a grievance officer under the DPDP Act?

The Act does not use the title grievance officer for every company. Section 8(10) requires an effective grievance redressal mechanism, and Rule 9 requires you to publish the business contact of your DPO, if you have one, or of a person who can answer questions about processing. Significant Data Fiduciaries must appoint a DPO who is the grievance contact.

### Can someone complain directly to the Data Protection Board?

Not as a first step. Under section 13, a person must first use the grievance redressal mechanism of the fiduciary or consent manager before approaching the Board. The Board is established but its Chairperson and Members had not been appointed as of November 2026.

### What is nomination under the DPDP Act?

Section 14 lets a person nominate another individual to exercise her rights if she dies or becomes incapable. You need a way to record nominations and to verify a nominee who later makes a request.