Skip to main content
DPDP Compliance
Home/DPDP Act/Chapter III — Rights and Duties of Data Principal
DPDP Act, 2023 · Chapter III of IX

Chapter III: Rights and Duties of Data Principal

Chapter III is the individual's side of the Act: four enforceable rights over their own personal data, and a short list of duties that keep those rights from being abused.

Sections 11–15 · 5 sectionsAll 5 sections effective 13 May 2027Reviewed September 2026
Back to the Full DPDP Act GuideChapter IV — Special Provisions
  1. 11Right to Access Information About Personal Data
  2. 12Right to Correction and Erasure of Personal Data
  3. 13Right of Grievance Redressal
  4. 14Right to Nominate
  5. 15Duties of Data Principal

Chapter summary

In plain terms: A Data Principal can ask what data is being processed and with whom it is shared (Section 11), ask for correction, completion, updating or erasure (Section 12), use a grievance process and expect a reply within the prescribed period (Section 13), and nominate someone to exercise these rights on death or incapacity (Section 14). Section 15 sets out duties — for example, not filing false complaints or impersonating another person.

How the sections fit together

Chapter III maps four rights onto a simple lifecycle. A person first asks what is held and who has it (Section 11). If something is wrong or no longer needed, they ask for correction, completion, updating or erasure (Section 12). If the organisation does not respond properly, they use its grievance process (Section 13). Section 14 allows them to name someone to act for them if they die or cannot act. Section 15 closes the chapter with the duties that the Data Principal owes in return.

For an organisation, each right becomes a workflow with an owner, a deadline and a record. For a Data Principal, the chapter is the list of things they can ask for and the order in which to ask.

Sections at a glance

Sections 11–15 of the DPDP Act, 2023. Select a section to open its own page, with the full explanation, a worked example and common questions.

Sec. 11Right to Access Information About Personal DataEffective 13 May 2027

Section 11 opens Chapter III's rights with the most foundational one: the right to actually find out what a Data Fiduciary is doing with your personal data, and who else it's been shared with.

Read the full explanation Sec. 12Right to Correction and Erasure of Personal DataEffective 13 May 2027

Section 12 gives Data Principals a direct lever over their own data quality and lifespan: the right to have inaccurate data corrected, incomplete data completed, and data erased once it's no longer needed.

Read the full explanation Sec. 13Right of Grievance RedressalEffective 13 May 2027

Section 13 requires every Data Fiduciary and Consent Manager to run a working, responsive grievance process — and makes using it a required first step before a Data Principal can take a complaint to the Board.

Read the full explanation Sec. 14Right to NominateEffective 13 May 2027

Section 14 is a short but distinctive right: letting a Data Principal name someone else in advance to exercise their data rights if they die or become incapacitated — a kind of digital-data succession planning built directly into the Act.

Read the full explanation Sec. 15Duties of Data PrincipalEffective 13 May 2027

Section 15 closes Chapter III with a short but important reminder: the Act's rights framework runs in both directions.

Read the full explanation

Key terms in this chapter

Right to access
The right to a summary of the personal data being processed, the processing activities, and the identities of other Data Fiduciaries and Data Processors the data has been shared with.
Right to correction
The right to have inaccurate or misleading data corrected, incomplete data completed, and data updated.
Right to erasure
The right to have data erased unless retention is necessary for the specified purpose or to comply with law.
Grievance redressal
The process every Data Fiduciary and Consent Manager must offer so a Data Principal can raise a complaint and get a reply.
Nominee
A person the Data Principal names to exercise the rights if the Data Principal dies or is unable to act.
Duties of Data Principal
Obligations such as not impersonating anyone, not suppressing material information, not filing false grievances, and giving only verifiably authentic information when asking for correction or erasure.

Why this chapter matters

These sections turn principles into operational requests. Each right becomes a workflow an organisation has to run: receiving a request, verifying the person, responding in time and logging the outcome. The duties in Section 15 matter because the Schedule allows a penalty for breaching them, which makes the Act a two-way framework rather than a one-sided one.

Who needs to care about this chapter

  • Individuals who want to understand what they can ask of the organisations holding their data.
  • Customer-support, privacy and grievance teams who will receive and process rights requests.
  • Product teams building preference centres, data-export and deletion features.
  • Consent Managers, who can help Data Principals exercise these rights.

Compliance checklist

Practical steps that follow from this chapter. Treat it as a starting point and adapt it to your sector and systems.

  • Set up a single intake point for access, correction, erasure and nomination requests.
  • Decide how you will verify the identity of the person making a request.
  • Define internal owners and response times for each right, within the period the Rules prescribe.
  • Keep a log of requests, actions taken and replies sent.
  • Make the nominee option available in your account or preference centre.
  • Publish the grievance contact and make sure staff know how to route complaints.
  • Check that vendors can support correction and erasure on data you share with them.

Common mistakes to avoid

  • Treating erasure as automatic without checking whether law or the stated purpose requires retention.
  • Forgetting to pass correction and erasure requests on to Data Processors.
  • Having no way for a nominee to prove their authority.
  • Sending Data Principals straight to the Board when the Act expects the organisation's own grievance process to be used first.

Related DPDP Rules

The Act sets the framework and the DPDP Rules, 2025 supply the operational detail. These Rules work with this chapter.

Rule 14 — Rights of Data Principals

Read the Rule

Rule 9 — Contact Information for Queries

Read the Rule

Rule 4 — Consent Manager Registration

Read the Rule

Common questions

Can I ask a company to delete my personal data?
Yes. Section 12 gives the right to erasure, subject to the company's need to retain data for the specified purpose or to comply with law. The company must act on a valid request.
Do I have to complain to the Data Protection Board first?
The Act expects a Data Principal to use the Data Fiduciary's own grievance redressal process first (Section 13) and approach the Board only if that does not resolve the matter.
Can a Data Principal be penalised?
The Schedule provides a penalty of up to ₹10,000 for breach of the duties in Section 15, such as registering a false or frivolous grievance. These duties are narrow and apply to individuals acting in bad faith.
How long does an organisation have to reply to a request?
The Rules set the period for responding to grievances and requests. Check Rule 14 for the current time limit, and build your internal deadlines inside it.
Can a Consent Manager help me exercise these rights?
Yes. A Consent Manager registered with the Board acts as a single point of contact through which a Data Principal can give, manage and withdraw consent, and its role connects to the exercise of these rights.
What happens if I name a nominee?
Section 14 lets you nominate an individual who can exercise your rights in the event of your death or incapacity, in the manner the Rules prescribe.
Does this right let us find out everything a company knows about us, from any source?
It applies to the Data Fiduciary you gave consent to (including under the Section 7(a) certain-legitimate-use ground) - it's not a general right to compel information from every organisation that might independently hold data about you.
Do we have to disclose that we shared data with police for a fraud investigation?
Generally, no - sub-section (2) exempts sharing made to an authorised Fiduciary on a written request for preventing, detecting or investigating an offence or cyber incident, or for prosecution, from the identity-disclosure and "other information" requirements. The Data Principal's basic data summary under clause (a) is still owed to them.
Can a Data Principal force us to delete data we're legally required to keep?
No - sub-section (3) exempts data whose retention is necessary for compliance with applicable law from the erasure obligation, for as long as that legal requirement applies.
Does the correction right let a Data Principal add new categories of data we didn't originally collect?
Sub-section (2)(b)'s "complete incomplete personal data" obligation is about completing data already within the existing processing relationship, not a general right to expand what's collected.
Can a Data Principal complain directly to the Data Protection Board without contacting us first?
Not properly - sub-section (3) requires the Data Principal to first exhaust the grievance-redressal opportunity with the Data Fiduciary or Consent Manager before approaching the Board.
Is there a fixed number of days we have to respond to a grievance?
The Act leaves the exact period to the DPDP Rules to prescribe, and that period can vary by class of Data Fiduciary, so check the applicable Rule for your organisation's specific timeframe.
Does the nominee get their own independent data rights once nominated?
No - sub-section (1) has the nominee exercise the original Data Principal's rights on her behalf in the event of death or incapacity, rather than granting the nominee a new, separate right of their own.
What counts as "incapacity" under this section?
Sub-section (2) defines it specifically as inability to exercise rights under the Act due to unsoundness of mind or infirmity of body - not general unavailability or a temporary inconvenience.
Can the Board actually penalise someone for a frivolous data-protection complaint?
Yes - while Section 15(d) states the duty, Section 28(12) gives the Board the specific power, at any stage after receiving a complaint, to issue a warning or impose costs if it finds the complaint false or frivolous.
Does Section 15 create obligations for Data Fiduciaries as well?
No - this section's duties fall on the Data Principal. Data Fiduciary obligations are set out separately in Chapter II (Sections 4-10).

Related pages

Chapter IV — Special Provisions

The next chapter of the Act.

Read Chapter IV

Chapter II — Obligations of Data Fiduciary

The previous chapter of the Act.

Read Chapter II

Full DPDP Act Guide

All 44 sections of the Act, grouped by chapter, with status.

View all chapters

Data Principal Rights

A plain-language guide to every right.

Read about your rights