What rights do individuals have under the DPDP Act?
The four rights you must be ready to honour.
Access and correction
Individuals can ask what personal data you hold about them, the processing activities, and who you've shared it with, and they can require you to correct, complete, update or erase it. Your systems need to be able to find a person's data across every store to answer.
Grievance and nomination
People have a right to an accessible grievance mechanism — and to escalate to the Board if you don't respond. They can also nominate someone to exercise their rights if they die or become incapacitated, which matters for accounts holding significant data.
Operationalising rights
Rights are only real if you can deliver them. Assign an owner, set service levels, log every request, and verify the requester's identity before disclosing or deleting. A tracker keeps you from missing deadlines and creates your audit trail.
Frequently asked questions
Can someone ask me to delete their data?
Yes. The right to erasure lets individuals require deletion when the purpose is served or consent is withdrawn, unless a law requires retention.
What is the right to nominate?
Data principals can nominate another person to exercise their DPDP rights in the event of death or incapacity.
What if I ignore a rights request?
The person can complain to the Data Protection Board, which can investigate and impose penalties. Build a process so requests don't slip.
Get ready for rights requests
Read the Data Principal Rights guide and set up a process to receive and fulfil requests.
Data Principal Rights