Understand Data Principal rights under India’s DPDP Act, including access, correction, erasure, grievance redressal and nomination, and prepare for 13 May 2027. 

India’s Digital Personal Data Protection (DPDP) Act, 2023 introduces an important change in how businesses manage digital personal data. Once the relevant substantive provisions commence, organisations within scope will need to protect the personal data they process and establish mechanisms that allow individuals to exercise their statutory rights. 

Under the Act, individuals are called Data Principals, while organisations determining the purpose and means of processing personal data are known as Data Fiduciaries. 

The Act establishes rights relating to: 

• Access to information about personal data processing 

• Correction, completion and updating 

• Erasure 

• Grievance redressal 

• Nomination 

These rights are supported by the DPDP Rules, 2025, which set out how organisations will need to enable Data Principals to exercise them.

The substantive Data Principal rights provisions, including Sections 11–14 and Rule 14, are scheduled to come into force on 13 May 2027 under the notified phased commencement framework. This article explains those forthcoming requirements and the preparation businesses should undertake before that date. The date is calculated from the Gazette dated 13 November 2025 and its 18-month commencement schedule. 

For businesses, preparing for DPDP Data Principal rights means more than updating a privacy policy or creating a customer support email address. Organisations should establish documented procedures, accessible request channels, appropriate identity-verification measures, reliable data inventories and coordination between internal teams and service providers. 

If you’re still familiarising yourself with the broader framework, our DPDP Act & Rules Complete Guide explains the key requirements, while our 25-Point DPDP Compliance Checklist covers wider implementation activities. 

This guide explains the key Data Principal rights, what they mean for businesses and how organisations can prepare to manage requests effectively. 

What Are Data Principal Rights Under the DPDP Act? 

Data Principal rights are statutory rights that enable individuals to obtain information about how their personal data is processed, request corrections or erasure, raise grievances and nominate another individual to exercise their rights in specified circumstances. 

Chapter III, Sections 11–14 of the DPDP Act, 2023 establishes these principal rights. 

Key Data Principal Rights 

The rights summarised above are scheduled to become applicable on 13 May 2027 and remain subject to the relevant provisions, procedures and exemptions under the DPDP framework. 

1. Right to Access Personal Data Under the DPDP Act 

Section 11 establishes the right to access information about personal data. This right is scheduled to come into force on 13 May 2027. The explanation below describes how it will operate after commencement. 

A Data Principal will be able to request prescribed information from a Data Fiduciary to whom they have previously given consent for processing. This includes the circumstances referred to in Section 7(a), where personal data has been voluntarily provided for a specified purpose and the individual has not indicated that they do not consent to its use. 

The information available under Section 11 includes: 

• A summary of the personal data being processed 

• A summary of the processing activities undertaken in relation to that personal data 

• The identities of other Data Fiduciaries and Data Processors with whom the personal data has been shared 

• A description of the personal data shared 

• Any other prescribed information relating to the personal data and its processing 

The Act provides an exception to specified disclosure requirements where personal data has been shared with another Data Fiduciary authorised by law to obtain it pursuant to a written request for preventing, detecting or investigating offences or cyber incidents, or prosecuting or punishing offences. 

Section 11 creates a right to obtain prescribed information about processing. It should not automatically be interpreted as an unrestricted right to receive copies of every internal document, system record or confidential business document maintained by an organisation. 

What Businesses Should Prepare 

Before commencement, businesses should establish processes to:

• Receive and register access requests 

• Identify personal data associated with the requester 

• Locate relevant processing records 

• Identify relevant data-sharing arrangements 

• Assess applicable disclosure restrictions 

• Prepare an appropriate response 

For example, after commencement, a customer using an online healthcare platform may request information about the personal data processed by the platform and the service providers with whom relevant information has been shared. 

The organisation would need to identify the applicable information across its systems and respond in accordance with Section 11. 

An effective DPDP access-request process therefore depends on accurate data mapping, reliable data-sharing records and clearly assigned responsibilities.

2. Right to Correction, Completion and Updating 

Section 12 establishes rights relating to the correction, completion and updating of personal data. These rights are scheduled to come into force on 13 May 2027. 

They concern personal data for which the individual previously gave consent, including the circumstances referred to in Section 7(a), and are subject to applicable legal requirements and procedures. 

Once these provisions commence, a Data Principal will be able to request a Data Fiduciary to: 

• Correct inaccurate or misleading personal data 

• Complete incomplete personal data 

• Update personal data 

  
  

For example, a customer may need to update a contact number, correct an incorrectly recorded name or complete missing information in an account. 

After commencement, when an applicable request is received, the Data Fiduciary will be required to address the correction, completion or updating requirement in accordance with the Act. 

What Businesses Should Prepare 

Organisations should establish a clear process for receiving and assessing correction requests. 

The process should enable the responsible team to: 

• Identify the relevant record 

• Verify the requester’s identity or authority where appropriate 

• Assess the requested change 

• Obtain proportionate supporting information where necessary 

• Update the relevant systems 

• Maintain evidence of the action taken 

  
  

Businesses should also identify whether personal data exists across multiple systems or has been shared with service providers. 

For example, correcting a customer’s contact information in a primary application may not automatically update information stored in a separate customer relationship management system. 

An effective correction-request workflow should address these dependencies and reduce the risk of maintaining inconsistent or outdated information. 

3. Right to Erasure of Personal Data 

Section 12 also provides for a right to request erasure of personal data, scheduled to come into force on 13 May 2027. The consent-related scope described above also applies to this right. However, the right to erasure is not absolute. 

Under Section 12(3), once applicable, a Data Fiduciary receiving an erasure request will be required to erase the Data Principal’s personal data unless retention remains necessary: 

• For the specified purpose; or 

• For compliance with applicable law 

Separately, Section 8(7), also scheduled to commence on 13 May 2027, establishes a broader obligation concerning retention. Unless retention is necessary for compliance with law, personal data will need to be erased when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, whichever occurs earlier. 

Businesses should assess an erasure request against the applicable statutory conditions rather than treating every request as an instruction to automatically delete all information associated with an individual. 

Example 

A customer may request deletion of personal data associated with an account they no longer use. 

The organisation should determine: 

• What personal data is associated with the customer 

• Whether the specified purpose continues to be served 

• Whether consent has been withdrawn, where relevant 

• Whether any information must be retained to comply with applicable law 

• Whether relevant Data Processors also need to erase information 

Certain information may therefore be erased while other records may need to be retained where a legal retention obligation applies. 

What Businesses Should Prepare 

Businesses should establish a documented personal data erasure process that enables them to: 

• Identify the relevant personal data 

• Assess the basis and circumstances of the request 

• Review applicable retention requirements 

• Identify systems and service providers holding the information 

• Carry out the required erasure 

• Document any applicable retention justification 

• Communicate the outcome appropriately 

Deletion procedures should cover both internal systems and relevant third-party processing arrangements. 

A deletion request should trigger an assessment of the personal data concerned, including relevant legal retention requirements.

4. Right to Grievance Redressal 

Section 13 establishes the right to grievance redressal, scheduled to come into force on 13 May 2027. The related Rule 14 requirements described below are also scheduled to commence on that date. 

Once applicable, a Data Principal will have the right to readily available means of grievance redressal concerning acts or omissions of a Data Fiduciary or Consent Manager relating to: 

• Their obligations under the DPDP framework; or 

• The exercise of Data Principal rights 

Businesses and Consent Managers should therefore prepare accessible mechanisms through which individuals can raise grievances. 

Under Rule 14(3) of the DPDP Rules, 2025, once applicable, every Data Fiduciary and Consent Manager will be required to prominently publish on its website or application the period within which grievances will be addressed. 

The published period must be reasonable and must not exceed 90 days. 

Organisations will also need appropriate technical and organisational measures to support compliance with their published grievance-redressal period. 

The 90-day limit applies to grievance redressal. It should not automatically be treated as the statutory response deadline for every access, correction or erasure request. 

What Businesses Should Prepare 

An effective grievance-redressal mechanism should include: 

• A clearly identified grievance channel 

• A process for recording incoming grievances 

• Defined responsibility for investigation 

• Internal escalation procedures 

• Tracking of response periods 

• Communication of outcomes 

• Retention of appropriate records 

  
  

DPO / Authorised Contact Details: Section 8(9) and Rule 9 

The contact requirement should be read alongside Section 8(9) of the DPDP Act and Rule 9 of the final DPDP Rules, 2025. 

Once these provisions commence, every Data Fiduciary will be required to prominently publish on its website or app the business contact information of: 

• Its Data Protection Officer, where applicable; or 

• A person able to answer questions on its behalf about the processing of the Data Principal’s personal data 

Rule 9 also requires these business contact details to be included in every response to a communication concerning the exercise of a Data Principal’s rights. 

This means the relevant contact details will need to be readily available to Data Principals both through the organisation’s website or app and through its rights-request responses. 

A formal DPO appointment is required for notified Significant Data Fiduciaries under Section 10(2)(a). The Act does not impose that appointment requirement on every business. Other Data Fiduciaries should designate a person capable of answering processing-related questions on their behalf. 

Section 6(3) separately requires consent requests to provide the contact details of the DPO, where applicable, or another person authorised to respond to communications concerning the exercise of Data Principal rights. 

These provisions are scheduled to commence on 13 May 2027. Businesses should prepare their website or app information, consent requests and response templates accordingly. 

Can a Data Principal Approach the Data Protection Board? 

Once Section 13 becomes applicable, a Data Principal will need to first exhaust the opportunity to resolve their grievance through the Data Fiduciary’s or Consent Manager’s grievance-redressal mechanism before approaching the Data Protection Board of India. 

Businesses should prepare internal grievance mechanisms that are accessible, documented and capable of investigating and responding to grievances appropriately. 

4. Right to Grievance Redressal 

Section 13 establishes the right to grievance redressal, scheduled to come into force on 13 May 2027. The related Rule 14 requirements described below are also scheduled to commence on that date. 

Once applicable, a Data Principal will have the right to readily available means of grievance redressal concerning acts or omissions of a Data Fiduciary or Consent Manager relating to: 

• Their obligations under the DPDP framework; or 

• The exercise of Data Principal rights 

Businesses and Consent Managers should therefore prepare accessible mechanisms through which individuals can raise grievances. 

Under Rule 14(3) of the DPDP Rules, 2025, once applicable, every Data Fiduciary and Consent Manager will be required to prominently publish on its website or application the period within which grievances will be addressed. 

The published period must be reasonable and must not exceed 90 days. 

Organisations will also need appropriate technical and organisational measures to support compliance with their published grievance-redressal period. 

The 90-day limit applies to grievance redressal. It should not automatically be treated as the statutory response deadline for every access, correction or erasure request. 

What Businesses Should Prepare 

An effective grievance-redressal mechanism should include: 

• A clearly identified grievance channel 

• A process for recording incoming grievances 

• Defined responsibility for investigation 

• Internal escalation procedures 

• Tracking of response periods 

• Communication of outcomes 

• Retention of appropriate records 

  
  

DPO / Authorised Contact Details: Section 8(9) and Rule 9 

The contact requirement should be read alongside Section 8(9) of the DPDP Act and Rule 9 of the final DPDP Rules, 2025. 

Once these provisions commence, every Data Fiduciary will be required to prominently publish on its website or app the business contact information of: 

• Its Data Protection Officer, where applicable; or 

• A person able to answer questions on its behalf about the processing of the Data Principal’s personal data 

Rule 9 also requires these business contact details to be included in every response to a communication concerning the exercise of a Data Principal’s rights. 

This means the relevant contact details will need to be readily available to Data Principals both through the organisation’s website or app and through its rights-request responses. 

A formal DPO appointment is required for notified Significant Data Fiduciaries under Section 10(2)(a). The Act does not impose that appointment requirement on every business. Other Data Fiduciaries should designate a person capable of answering processing-related questions on their behalf. 

Section 6(3) separately requires consent requests to provide the contact details of the DPO, where applicable, or another person authorised to respond to communications concerning the exercise of Data Principal rights. 

These provisions are scheduled to commence on 13 May 2027. Businesses should prepare their website or app information, consent requests and response templates accordingly. 

Can a Data Principal Approach the Data Protection Board? 

Once Section 13 becomes applicable, a Data Principal will need to first exhaust the opportunity to resolve their grievance through the Data Fiduciary’s or Consent Manager’s grievance-redressal mechanism before approaching the Data Protection Board of India. 

Businesses should prepare internal grievance mechanisms that are accessible, documented and capable of investigating and responding to grievances appropriately. 

5. Right to Nominate Another Individual 

Businesses should also prepare for the right to nomination. 

Under Section 14, a Data Principal will be able to nominate another individual to exercise their rights in the event of death or incapacity. This right is scheduled to come into force on 13 May 2027. 

For this purpose, incapacity refers to inability to exercise these rights due to unsoundness of mind or infirmity of body. 

Rule 14(4) provides for nomination of one or more individuals, in accordance with: 

• The Data Fiduciary’s terms of service 

• Applicable law 

• The means and particulars required by the Data Fiduciary 

  
  

Businesses should establish processes for: 

• Recording nominations 

• Maintaining relevant nomination information 

• Identifying the nominated individual 

• Verifying authority when the nomination becomes applicable 

• Processing rights requests submitted by an authorised nominee 

The process should distinguish statutory nomination from ordinary account delegation or authorisation to share information with another individual. 

How Should Businesses Manage Data Principal Requests? 

An effective Data Principal rights-management system should connect the request-submission process with the teams, systems and service providers responsible for processing personal data. 

Businesses should establish and test a standard request-handling workflow before 13 May 2027. The workflow below is preparation guidance for the forthcoming DPDP rights provisions. 

Recommended Data Principal Request Workflow 

1. Receive and Register 

Provide an accessible submission channel and create a record of the request. 

2. Verify the Requester 

Use appropriate and proportionate measures to confirm the identity or authority of the individual, based on the nature of the request and the information required. 

Verification should provide sufficient assurance that the request is being handled for the appropriate person without unnecessarily collecting additional personal information. 

3. Classify and Assess 

Identify whether the request concerns: 

• Access 

• Correction 

• Completion 

• Updating 

• Erasure 

• Nomination 

• Grievance redressal 

Assess the relevant statutory conditions and requirements. 

4. Locate and Review the Data 

Identify relevant: 

• Personal data 

• Processing activities 

• Systems 

• Data-sharing arrangements 

• Data Processors 

• Retention requirements 

• Disclosure restrictions

  
  

5. Implement the Required Action 

Coordinate with the responsible internal teams and relevant service providers to complete the applicable action. 

6. Respond and Retain Evidence 

Communicate the outcome and maintain appropriate records covering: 

• The request 

• Verification performed 

• Assessment 

• Decision 

• Action taken 

• Response provided 

  
  

Prepare response templates that include the DPO or relevant contact person’s business contact details, as required by Rule 9 once applicable. 

This workflow is practical implementation guidance and is not a separately prescribed statutory sequence under the DPDP Act. 

Organisations should assign responsibility for each stage and maintain escalation procedures for complex requests, disputes or matters requiring legal assessment.

What Does Rule 14 Require Businesses to Publish? 

Rule 14 of the final DPDP Rules, 2025 sets out requirements concerning how Data Principals exercise their rights. It is scheduled to come into force on 13 May 2027. 

Means Available to Exercise Rights 

Under Rule 14(1)(a), a Data Fiduciary and, where applicable, a Consent Manager will need to prominently publish on its website or app, or both, details of the means through which a Data Principal can make a request to exercise their rights. 

As practical implementation options, these means could include a designated email address, an online request form or an account-based request facility. The published instructions should accurately reflect the channels the organisation actually provides. 

Particulars Required to Identify the Data Principal 

Under Rule 14(1)(b), the organisation will also need to prominently publish the particulars, if any, required to identify the Data Principal under its terms of service, such as a username or another identifier. 

Rule 14(5) explains that an identifier is a sequence of characters issued by the Data Fiduciary to identify the Data Principal. Examples include: 

• Customer identification file number 

• Customer acquisition form number 

• Application reference number 

• Enrolment ID 

• Email address 

• Mobile number 

• Licence number 

These are examples of identifiers that can enable identification. They are not a mandatory list of information or documents that every requester must submit. 

Businesses should clearly explain which identifying particulars are required for their own request process. Any additional verification should remain proportionate to the request. 

How Requests Are Submitted 

Rule 14(2) provides for the Data Principal to submit a request to the Data Fiduciary to whom they previously gave consent, using the means and furnishing the particulars required by that Data Fiduciary. 

Published instructions should therefore connect the available request channels with the information needed to identify the requester and locate the relevant records. 

Grievance-Response Period 

Under Rule 14(3), every Data Fiduciary and Consent Manager will need to prominently publish a reasonable grievance-response period that does not exceed 90 days. 

Appropriate technical and organisational measures will also be required to make the grievance-redressal system effective in responding within that period. 

Nomination Process 

Rule 14(4) provides for nomination of one or more individuals using the required means and particulars, in accordance with the Data Fiduciary’s terms of service and applicable law. 

Businesses should prepare clear instructions for recording nominations and handling requests when a nomination becomes applicable. 

A dedicated privacy-rights page or request portal may help consolidate this information. However, the Rules do not require every organisation to purchase or develop a particular rights-management portal.

When Do DPDP Data Principal Rights Come Into Force? 

The DPDP framework follows a phased commencement model rather than a single compliance date. 

The dates above are calculated using the Gazette dated 13 November 2025 and the notified phased commencement periods. 

For Data Principal rights specifically, 13 May 2027 is the key scheduled commencement date. 

Businesses should use the implementation period to establish and test their rights-management processes before the applicable provisions take effect. 

DPDP Data Principal Rights Compliance Checklist 

Use this checklist to assess readiness ahead of 13 May 2027: 

• Identify and document personal data processing activities 

• Maintain an accurate personal data inventory 

• Establish accessible channels for Data Principal requests 

• Prepare the request channels and identification particulars to be published under Rule 14 

• Prepare the DPO or relevant contact details required under Section 8(9) and Rule 9 

• Include those business contact details in rights-response templates 

• Check that consent requests include the contact details required under Section 6(3) 

• Implement appropriate and proportionate requester-verification procedures 

• Develop workflows for access requests 

• Establish correction, completion and updating procedures 

• Develop an erasure and retention-assessment process 

• Establish a grievance-redressal mechanism 

• Define and prepare to publish the grievance-response period 

• Establish a nomination-management process 

• Assign responsibilities for rights requests 

• Coordinate relevant requests with Data Processors and service providers 

• Maintain evidence of requests, assessments, actions and responses 

• Train employees responsible for request handling 

• Test request-handling procedures before the applicable provisions commence 

Common Data Principal Rights Compliance Mistakes 

Businesses should avoid treating Data Principal request handling as an isolated customer-support activity. 

Common implementation gaps to address before commencement include the following. 

Incomplete Data Inventories 

If an organisation does not know where personal data is stored, responding accurately to access, correction or erasure requests can become difficult. 

Inaccessible Request Channels 

Individuals should be able to understand how to exercise their rights using the mechanisms published by the organisation. 

Unclear Identification Requirements 

Publishing a request channel without explaining the identifying particulars required can result in incomplete requests, unnecessary follow-ups and delays. 

Excessive Identity Verification 

Verification should be appropriate and proportionate to the request. Organisations should avoid requesting unnecessary personal information merely to verify identity. 

Inconsistent Updates Across Systems 

Correcting information in one application may not automatically update the same information stored elsewhere. 

Automatic Deletion Without Retention Assessment 

Not every erasure request requires unconditional deletion. Relevant statutory and legal retention conditions should first be assessed. 

Treating 90 Days as the Deadline for Every Request 

The maximum 90-day period prescribed by Rule 14(3) specifically concerns the organisation’s grievance-redressal system. It should not automatically be applied as the statutory response period for every category of Data Principal request. 

Missing Contact Details in Responses 

Once Rule 9 becomes applicable, publishing contact details on a website or app alone will not meet the complete requirement. The relevant business contact information will also need to appear in every response concerning the exercise of Data Principal rights. 

Poor Documentation 

Businesses should retain appropriate evidence of requests, assessments, decisions and actions to support accountability. 

A practical Data Principal rights-management process should reflect both the applicable legal requirements and the organisation’s actual processing environment. 

Conclusion 

DPDP Data Principal rights management is an important part of building an effective data-protection compliance programme. 

Businesses should prepare to receive, assess and respond to applicable requests concerning access, correction, completion, updating, erasure, grievance redressal and nomination. 

Effective implementation depends on accurate data inventories, clearly assigned responsibilities, proportionate verification, reliable technical processes and coordination between internal teams and Data Processors. 

Preparing the information required under Rule 14, making the relevant contact details available under Rule 9 and testing request-handling workflows ahead of 13 May 2027 will help businesses establish a practical approach to managing Data Principal rights when the substantive provisions commence.