Section 15: Duties of Data Principal
Section 15 closes Chapter III with a short but important reminder: the Act's rights framework runs in both directions. Data Principals have specific duties too — not impersonating others, not suppressing material information, not filing frivolous complaints, and providing only genuine information when exercising their own rights.
Quick summary
What Section 15 says
- Clause (a) — comply with the provisions of all applicable laws while exercising rights under the Act.
- Clause (b) — ensure not to impersonate another person while providing personal data for a specified purpose.
- Clause (c) — ensure not to suppress any material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities.
- Clause (d) — ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board.
- Clause (e) — furnish only information that is verifiably authentic, while exercising the right to correction or erasure under the Act or rules.
Breaking it down
Every duty here targets a specific way the rights framework in the rest of the Act could otherwise be abused — identity fraud, misrepresentation to the State, and vexatious use of the grievance and complaint system.
- (a)
Follow the law
Comply with all applicable laws while exercising rights.
- (b)
No impersonation
Don't impersonate another person when providing data.
- (c)
No suppression
Don't hide material facts on State-issued documents or identifiers.
- (d)
No frivolous complaints
Don't file false or frivolous grievances or complaints.
- (e)
Authentic information
Give only verifiably authentic information for correction or erasure.
Clauses (b) and (c) are squarely about identity integrity. Impersonation when providing data, and suppressing material facts on State-issued documents or identifiers, both attack the reliability of records the whole system depends on — these aren't really “data protection” duties so much as basic honesty requirements the Act chooses to state explicitly.
Clause (d) has real teeth elsewhere in the Act. This duty isn't just aspirational — Section 28(12) specifically empowers the Board to issue a warning or impose costs on a complainant if, at any stage, it finds a complaint false or frivolous. A Data Principal considering a complaint should treat clause (d) as backed by an actual consequence, not just a statement of principle.
Clause (e) mirrors the good faith the Act expects from Fiduciaries. Just as Section 6(10) puts the burden on a Fiduciary to prove valid consent, clause (e) puts a parallel honesty obligation on the Data Principal when exercising correction or erasure rights — the information they supply to justify a correction has to itself be verifiably authentic, not simply asserted.
Why this section matters
It's easy to read a chapter titled “Rights and Duties of Data Principal” and focus only on the rights. Section 15 is a reminder that the Act's protections rely on a baseline of good faith from Data Principals too — and that misusing the grievance system, impersonating someone else, or supplying false information carries its own consequences, most visibly the Board's power under Section 28(12) to penalise frivolous complaints.
Real-world example
A dispute over a corrected address on a government-linked identity document
Two scenarios illustrate how Section 15 plays out in practice:
- Scenario one — an individual applies for a State-issued identity document and deliberately omits a material fact affecting their eligibility. This breaches clause (c) — suppressing material information on a State-issued document or identifier — regardless of whether any Data Fiduciary obligation was also breached.
- Scenario two — a customer, annoyed after a minor service delay unrelated to data handling, files a data-protection complaint against a company purely to pressure it, despite having no actual data-rights grievance. If the Board finds the complaint false or frivolous, clause (d) is the duty being breached — and Section 28(12) gives the Board the power to issue a warning or impose costs on the complainant as a result.
Who needs to care about this section
- Data Principals exercising any right under the Act — these duties apply alongside, not instead of, the rights in Sections 11–14.
- Data Fiduciaries handling identity-verification and onboarding — clause (b)'s anti-impersonation duty is relevant context for KYC and identity-proofing processes.
- Anyone considering filing a Board complaint — clause (d) is directly backed by Section 28(12)'s power to warn or impose costs for a false or frivolous complaint.
Common questions
Can the Board actually penalise someone for a frivolous data-protection complaint?
Does Section 15 create obligations for Data Fiduciaries as well?
What does "verifiably authentic" mean for a correction request under clause (e)?
Related sections
Section 16 — Processing of Personal Data Outside India
Continue to the next section in sequence.
Read Section 16Section 14 — Right to Nominate
Go back to the previous section.
Read Section 14Chapter III — Rights and Duties of Data Principal
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sections