Right to Access Information
A Data Principal’s right to ask for a summary of her personal data and how it is processed.
This is your right to ask an organisation what personal data of yours it is processing, what it does with it, and which other organisations it has passed it to.
Meaning of Right to Access Information
The person can ask for a summary of the personal data being processed and the processing activities, and for the identities of all other fiduciaries and processors with whom the data has been shared, with a description of the data shared. The right is framed around data processed with consent or voluntarily provided.
Section 11 of the DPDP Act gives a Data Principal the right to obtain information from a Data Fiduciary to whom she has previously given consent, including consent treated as given under Section 7(a) for voluntarily provided data. She makes a request in the prescribed manner and is entitled to a summary of the personal data being processed and the processing activities undertaken, and to the identities of all other Data Fiduciaries and Data Processors with whom her data has been shared, along with a description of the data shared.
The right is framed around the fiduciary that holds her consent. It is not a general power to ask any organisation whether it has information about you. A person who never dealt with a company, or whose data was processed under another legitimate use, may not be able to rely on Section 11 against that company. The Rules may also prescribe further information that has to be provided under clause (c).
The right is about information, not a copy of every record. The Act asks for a summary and for the list of recipients, which is different from a full data export. Section 11(2) also carves out disclosures: the identities of recipients and the other prescribed information need not be given where data was shared with another fiduciary authorised by law, on a written request, for preventing, detecting or investigating offences or cyber incidents, or prosecuting or punishing offences.
Rule 14 turns the right into a process. Fiduciaries must prominently publish how a request can be made and which particulars, such as a username or customer ID, the person must provide, and they must respond within the grievance period of no more than ninety days. Access differs from correction and erasure under Section 12, which let a person change or remove data, and from the GDPR right of access, which usually includes a full copy of the data.
Examples of Right to Access Information
A customer asks an online retailer for a summary of her data and a list of the delivery and payment companies that received it.
A customer asks the retailer what it holds about her. The reply lists her profile, order and browsing data, the purposes, and names the courier and payment partners that received her details, with the data type each received.
A former employee asks for a summary of the data processed during employment. The company confirms the categories it still holds, explains why payroll records are kept, and lists its payroll and insurance vendors.
A user asks which parties received her details. The app lists its credit-bureau and KYC partners, but does not name an agency that received data on a written request for a cyber incident inquiry, which Section 11(2) permits.
Why Right to Access Information matters
For individuals the right is the starting point of every other right. A person cannot ask for correction or erasure without knowing what is held and who has it. The list of recipients is especially useful when she wants to find out who bought or received her data after a marketing or insurance enquiry.
For organisations, failing to give effect to rights is a breach that may be penalised under the residual head of up to ₹50 crore, after an inquiry by the Board. A fiduciary that cannot say where a customer's data went, because it lacks a data map, will also struggle with breach notification and with the Section 8(1) responsibility for its processors.
How it works in practice
- 1Publish the request channel on your website and app, as Rule 14 requires, naming the identifiers a person needs to supply and a contact person or team who handles it.
- 2Verify the requester before releasing anything, using the identifier she gave and, where needed, a one-time code to her registered mobile number, so a stranger cannot extract someone else's information.
- 3Maintain a live data map listing each system, the purposes, and every processor or fiduciary the data is shared with, so you can produce the summary and recipient list without a manual hunt.
- 4Set an internal deadline well inside ninety days, track every request in a log, and reply in plain language with the summary, recipients and a note of any information withheld under Section 11(2).
- 5Record the request, the reply and the date, and review the log periodically for patterns that show weak points in your processes.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Sending a dump of raw database rows. The Act asks for a clear summary and recipients, which a person can actually understand.
Replying only with what your own team holds. Section 11 also covers data shared with processors and other fiduciaries.
Making people write letters to a postal address. Rule 14 expects an easily found means of making the request.
Compliance tips
Build the data map now; it supports access requests, breach response and erasure at the same time.
Write reply templates in plain English and Hindi, and keep a checklist for what can lawfully be withheld.
Never release data until identity is confirmed, because wrongful disclosure is itself a security failure.
Common questions about Right to Access Information
Can I ask any company what data it has on me?
Section 11 is framed around a fiduciary to whom you have previously given consent, including voluntary provision under Section 7(a). It is not a general right against every organisation that may hold information about you.
Will I get a copy of all my data?
The Act gives a right to a summary of the data and processing activities, plus the identities of those it was shared with. It does not set out a full-copy or portability right like GDPR, though a fiduciary may choose to give more.
How long does a company have to respond?
Rule 14 requires fiduciaries to publish a response period of not more than ninety days for grievances. That is a ceiling. A fiduciary should aim to reply sooner where it reasonably can and say what period it has committed to.