Duties of the Data Principal
The obligations the Act places on individuals: follow the law, do not impersonate, do not suppress information, do not file false complaints.
The Act asks individuals to act in good faith when using their data rights: follow the law, do not impersonate anyone, do not hide material facts, do not file false complaints, and give only genuine information.
Meaning of Duties of the Data Principal
A Data Principal must comply with applicable laws, not impersonate another person while providing data, not suppress material information when giving data for official documents, not file a false or frivolous grievance or complaint, and give only verifiable, authentic information when asking for correction or erasure. Breaching these duties can attract a penalty of up to Rs 10,000.
Section 15 of the DPDP Act lists five duties of a Data Principal. She must comply with the provisions of all applicable laws while exercising rights under the Act; not impersonate another person while providing personal data for a specified purpose; not suppress material information when providing personal data for any State-issued document, unique identifier, proof of identity or proof of address; not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and furnish only verifiably authentic information when exercising the right to correction or erasure.
Most data protection laws focus on duties of organisations. The Indian Act adds duties for individuals because the rights it creates can be misused. A person who asks for erasure using a forged identity could delete someone else's records, and a flood of baseless complaints can clog the Board and the grievance desk of a small business. The duties are meant to protect the integrity of the whole system.
The duties are not a precondition to having rights. Section 15 does not say that rights are lost if a duty is breached, and it should not be used by fiduciaries to refuse reasonable requests. What it does is provide a basis for action when someone abuses the process: the penalty for breach of duties in the Schedule is up to ₹10,000, and the Board may under Section 28(12) issue a warning or impose costs on a complainant who files a false or frivolous complaint.
The duties also sit alongside other laws. Impersonation may be a separate offence under the Bharatiya Nyaya Sanhita or the IT Act, and providing false information for a State-issued document may be an offence under the relevant law. The DPDP Act does not replace these but adds a data-specific consequence.
Examples of Duties of the Data Principal
A person files a deliberately false complaint with the Board against a company to harass it. That breaches the Data Principal's duty.
Someone submits a correction request using a stranger's name and number to change the registered mobile. The app's identity check fails, the request is refused, and the real customer is alerted.
A customer files the same baseless complaint five times with the grievance desk to pressure a refund. The company documents each reply, and if the matter reaches the Board, it can show the complaint was not substantiated.
An applicant omits a prior surname while applying for a State-issued identity document. This is suppression of material information, which breaches Section 15(c) and may also have consequences under the law governing that document.
Why Duties of the Data Principal matters
For individuals, the duties are a reminder that rights come with responsibility. A person who files a complaint to harass a business, or uses someone else's identity to obtain data, faces a penalty and may be ordered to pay costs, and her complaint may be dismissed.
For organisations, the duties give a legal footing for sensible verification and for resisting abusive requests. A fiduciary that is firm and fair, asking for proof of identity before disclosure and recording why a complaint is unfounded, can protect itself and other users. The ceiling of ₹10,000 is modest, but the practical value is in setting a norm.
How it works in practice
- 1Include a short, plain-language statement of the individual's duties in the rights section of your privacy page, so that users know what is expected when they submit a request.
- 2Verify identity before acting on correction, erasure or access requests, and ask for authentic supporting proof where a request would change identity-related data.
- 3Keep a clear record of how you assessed a complaint, including evidence that it was false or frivolous, before you tell anyone it falls under Section 15(d).
- 4Do not threaten users with penalties in routine communications. Reserve any reference to Section 15 for clear cases and take legal advice before escalating to the Board.
- 5Train staff to be courteous: most unreasonable requests come from confused people, not bad actors, and a helpful explanation usually resolves them.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing individuals cannot be penalised under the Act. Section 15 and the Schedule provide up to ₹10,000 for breach of duties.
Using the duties as an excuse to ignore difficult customers. A complaint is not false just because it is unwelcome.
Overlooking that the duty applies to complaints made to the Board as well as to fiduciaries.
Compliance tips
State the duties in neutral, friendly language so they read as guidance, not a threat.
Keep evidence of identity checks so you can show a refusal was reasonable.
Escalate only repeated, clearly abusive behaviour, and involve legal counsel first.
Common questions about Duties of the Data Principal
Does the DPDP Act place duties on individuals?
Yes. Section 15 lists duties for Data Principals: comply with applicable laws, do not impersonate, do not suppress material information on State-issued documents, do not file false or frivolous complaints, and give verifiably authentic information for correction or erasure.
What is the penalty if a Data Principal breaches her duties?
The Schedule to the Act sets a maximum penalty of ₹10,000 for breach of the duties in Section 15. The Board imposes it after an inquiry, and may separately warn or impose costs on a complainant under Section 28(12) if a complaint is false or frivolous.
Can a company refuse my request because I breached a duty?
A company should not refuse a valid request on that basis alone. Section 15 does not take away rights. It supports checks such as identity verification and action against truly abusive use. A refusal should be reasoned, documented and open to complaint.