How do I handle a data access request under DPDP?

Rights

How do I handle a data access request under DPDP?

A repeatable process for access requests that won't blow your deadlines.

Quick Answer: To handle a data access request under DPDP, verify the requester's identity, locate all of their personal data across your systems, compile what you're required to share (the data, processing activities and recipients), respond within a reasonable timeframe, and log the request and your response. A standard workflow with an owner and a tracker keeps requests from being missed and gives you evidence you complied.

Verify before you act

Confirm the requester is who they claim before disclosing anything — a careless response to an impersonator is itself a breach. Use proportionate verification: enough to be confident, not so much that you collect excessive new data.

Find the data everywhere

Personal data hides in CRMs, support tools, email, spreadsheets, backups and vendor systems. A data inventory and mapping make this fast; without them, every request becomes a manual scramble. Include data held by your processors.

Respond and record

Provide the required information clearly, within a reasonable time, and keep a record of the request, what you disclosed, and when. Consistency matters — a documented, repeatable workflow protects you if a requester escalates to the Board.

Frequently asked questions

How long do I have to respond to a DSAR?

Within a reasonable timeframe. Set an internal SLA and track it; undue delay can become a grievance to the Board.

Do I have to verify the requester?

Yes. Verify identity proportionately before disclosing or deleting data to avoid handing data to an impersonator.

Does a DSAR include data held by my vendors?

Yes. You're accountable for personal data your processors hold on your behalf, so include it in your response.

Track every access request

Use the DSAR Request Tracker to log, assign and close requests within your SLA.

DSAR Request Tracker