Right to Access
Knowing exactly what data a company holds about you.
🎯 Learning Objectives
- ▸ Understand the scope of the right to access
- ▸ Learn what information a Data Fiduciary must provide
- ▸ Understand the time limit for response
The Right to Know
Before the DPDPA, if you wanted to know what data a company had about you, they could easily ignore you. Now, it is a legal right. Under Section 11, every Data Principal has the right to obtain from the Data Fiduciary:
- • A summary of the personal data being processed.
- • The identities of all other Data Fiduciaries and Data Processors with whom the data has been shared.
- • A description of the personal data shared.
- • The purposes for which the data was shared.
This right is crucial for transparency. If you do not know who has your data, you cannot hold them accountable.
How to Exercise It
You exercise this right by submitting a request to the Data Fiduciary. The Act requires companies to establish a mechanism (usually an email or a web form) to handle these requests. You can also use a Consent Manager.
💡 Example
If you want to know what a social media app knows about you, you can send a request to their Grievance Officer or DPO. They must provide you with a summary of your data, such as your profile details, browsing history, and location data they have stored.
📖 Glossary
- Data Fiduciary
- The entity that decides why and how your data is processed.
- Data Processor
- The entity that processes data on behalf of the Fiduciary.
🔑 Key Takeaways
- You can ask for a summary of the data held about you.
- You can ask for the identities of all third parties with whom your data is shared.
- The company must provide this within a reasonable time.
📚 Further Reading
- DPDPA Section 11 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...