Section 11: Right to Access Information About Personal Data

Quick summary

What Section 11 says

• Sub-section (1) — a Data Principal has the right to obtain from the Data Fiduciary to whom she has previously given consent (including consent under Section 7(a)'s certain-legitimate-use), upon making a request in the prescribed manner, (a) a summary of her personal data being processed and the processing activities undertaken; (b) the identities of all other Data Fiduciaries and Data Processors her data has been shared with, along with a description of the data so shared; and (c) any other prescribed information related to her personal data and its processing.
• Sub-section (2) — clauses (b) and (c) of sub-section (1) don't apply to sharing of personal data by the Fiduciary with another Fiduciary authorised by law, made pursuant to a written request, for preventing, detecting or investigating an offence or cyber incident, or for prosecuting or punishing offences.

Breaking it down

This is the Act's version of a “right to know” — and it's more than just seeing your own profile data. It specifically includes the processing activities being carried out and, critically, a map of who else has received your data.

Three distinct pieces of information, on request.

1. Clause (a)

   Summary

   Your personal data being processed and the processing activities undertaken.

2. Clause (b)

   Who has it

   Identities of every other Fiduciary and Processor it was shared with, and what was shared.

3. Clause (c)

   Anything else

   Any further information the Rules prescribe about your data and its processing.

The exception exists to protect law-enforcement and security sharing, not to weaken the right generally. Sub-section (2)'s carve-out is narrow and specific: it only removes the identity-disclosure and “other information” elements, only for sharing that was itself lawfully authorised and made on a written request for offence/cyber-incident prevention, detection, investigation, prosecution or punishment. A Data Principal still gets the core summary of their data under clause (a) even in these situations — the exception doesn't erase the whole right.

This right only attaches where consent was the basis (including Section 7(a)). Sub-section (1) is framed around “the said Data Fiduciary” — the one the Data Principal previously gave consent to, expressly including the Section 7(a) certain-legitimate-use ground (voluntarily provided data). It isn't framed as a universal right to interrogate every organisation that might hold data about you regardless of basis.

Why this section matters

Every other right in Chapter III — correction, erasure, grievance redressal — depends on first knowing what data exists and where it's gone. Section 11 is the entry point: without it, a Data Principal has no practical way to exercise the rights that follow.

Real-world example

Who needs to care about this section

• Customer support and data-rights teams — this is usually the first right an organisation needs an operational process for, since it's the gateway request most Data Principals make first.
• Any organisation sharing data with multiple downstream parties — sub-section (1)(b) means you need to actually track and be able to produce a list of who data has gone to, not just what data you hold yourself.
• Law-enforcement liaison and legal teams — sub-section (2)'s exception needs careful, narrow application, since it only covers specific categories of authorised sharing, not general business disclosures.

Common questions

Related sections