Rights of Data Principals under the DPDP Act 2023
The Digital Personal Data Protection Act, 2023 has fundamentally changed how Indian citizens interact with their digital data. As a Data Principal, you are no longer just a passive user; you are the legal owner of your data. The Act grants you six powerful, enforceable rights against any organisation (Data Fiduciary) processing your information. This guide explains each right, how to exercise it, and what to do if your rights are violated.
The 6 Data Rights at a Glance
Right to Access Information
Section 11Know exactly what data is being collected about you.
Under Section 11 of the DPDP Act, every individual has the right to request a summary of their personal data being processed by a Data Fiduciary. You can ask for the specific purposes of processing, the categories of data involved, and the identities of any other entities with whom your data has been shared. This ensures complete transparency.
Right to Correction and Erasure
Section 12Correct inaccuracies or request deletion.
You have the legal right to request the correction of inaccurate, misleading, or incomplete personal data. Furthermore, you can demand the erasure of your data (Right to be Forgotten) once the purpose of collection is fulfilled, or if you withdraw your consent, unless retention is mandated by law.
Right to Grievance Redressal
Section 13A readily available mechanism to file complaints.
Section 13 mandates that every Data Fiduciary must provide an easily accessible grievance redressal mechanism. If an organisation fails to resolve your complaint within a reasonable timeframe, you have the right to escalate the matter directly to the Data Protection Board of India (DPBI).
Right to Data Portability
Section 13(2)Transfer your data seamlessly.
As a Data Principal, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. This allows you to seamlessly transfer your data from one Data Fiduciary to another without any technological hindrances.
Right to Nominate
Section 14Appoint a representative for your digital rights.
In the unfortunate event of death or incapacity, you have the right to nominate another individual to exercise your rights on your behalf. This ensures that your digital legacy and privacy preferences are legally respected even in your absence.
Right to Withdraw Consent
Section 6(4)You are in control of your consent.
If your data is being processed based on your consent, you retain the absolute right to withdraw it at any time. Once withdrawn, the Data Fiduciary must cease processing your data immediately. The process to withdraw consent must be as easy as it was to give it.
Detailed Breakdown of Each Right
The six rights are not just abstract principles � they are enforceable legal rights backed by the Data Protection Board. Here is what each right means in practice, including the specific actions you can take.
Right to Access Information
Section 11Know exactly what data is being collected about you.
Under Section 11 of the DPDP Act, every individual has the right to request a summary of their personal data being processed by a Data Fiduciary. You can ask for the specific purposes of processing, the categories of data involved, and the identities of any other entities with whom your data has been shared. This ensures complete transparency.
What this means in practice:
- ?You can request a summary of personal data being processed
- ?You can ask for the purposes of processing
- ?You can ask for the categories of data shared with third parties
- ?You can ask for the identities of all Data Fiduciaries with whom data has been shared
- ?The Data Fiduciary must respond within a reasonable time
Right to Correction and Erasure
Section 12Correct inaccuracies or request deletion.
You have the legal right to request the correction of inaccurate, misleading, or incomplete personal data. Furthermore, you can demand the erasure of your data (Right to be Forgotten) once the purpose of collection is fulfilled, or if you withdraw your consent, unless retention is mandated by law.
What this means in practice:
- ?You can request correction of inaccurate or misleading data
- ?You can request completion of incomplete data
- ?You can request erasure when the purpose is no longer served
- ?You can request erasure when you withdraw consent
- ?Erasure can be refused if retention is required by law
Right to Grievance Redressal
Section 13A readily available mechanism to file complaints.
Section 13 mandates that every Data Fiduciary must provide an easily accessible grievance redressal mechanism. If an organisation fails to resolve your complaint within a reasonable timeframe, you have the right to escalate the matter directly to the Data Protection Board of India (DPBI).
What this means in practice:
- ?Every Data Fiduciary must publish grievance officer details
- ?You can file a complaint directly with the Data Fiduciary
- ?The grievance must be resolved within the prescribed time
- ?If unresolved, you can escalate to the Data Protection Board
- ?The Board can investigate and impose penalties
Right to Data Portability
Section 13(2)Transfer your data seamlessly.
As a Data Principal, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. This allows you to seamlessly transfer your data from one Data Fiduciary to another without any technological hindrances.
What this means in practice:
- ?Receive your data in a structured, machine-readable format
- ?Transfer your data to another Data Fiduciary
- ?The Data Fiduciary must facilitate the transfer
- ?Applies to data provided by you or generated through your use
- ?Not applicable where it would harm the rights of others
Right to Nominate
Section 14Appoint a representative for your digital rights.
In the unfortunate event of death or incapacity, you have the right to nominate another individual to exercise your rights on your behalf. This ensures that your digital legacy and privacy preferences are legally respected even in your absence.
What this means in practice:
- ?Nominate an individual to exercise your rights on your behalf
- ?Applies in the event of death or incapacity
- ?The nominee can exercise all your rights
- ?The nomination must be made in the prescribed manner
- ?The Data Fiduciary must honour the nomination
Right to Withdraw Consent
Section 6(4)You are in control of your consent.
If your data is being processed based on your consent, you retain the absolute right to withdraw it at any time. Once withdrawn, the Data Fiduciary must cease processing your data immediately. The process to withdraw consent must be as easy as it was to give it.
What this means in practice:
- ?You can withdraw consent at any time
- ?The withdrawal process must be as easy as giving consent
- ?The Data Fiduciary must cease processing immediately
- ?Withdrawal does not affect prior lawful processing
- ?You can request erasure after withdrawal
How to Exercise Your Rights
Knowing your rights is one thing; exercising them is another. Here is the step-by-step process to enforce your rights against a Data Fiduciary:
Identify the Data Fiduciary
Find out which organisation is processing your data. Check their privacy policy, notices, and the grievance officer details published on their website.
Submit a Written Request
Write to the Grievance Officer (email or physical post) clearly stating which right you want to exercise. Attach proof of identity, if required.
Wait for the Response
The Data Fiduciary must respond within the time prescribed under its policy (usually 30 days). Keep records of all communications.
Escalate to the Board
If the Data Fiduciary fails to respond or rejects your request unfairly, file a complaint with the Data Protection Board of India.
Seek Judicial Remedy
For serious violations, you can also approach consumer forums or constitutional courts. Legal remedies supplement the DPDP framework.
Limitations on These Rights
The rights are powerful, but they are not absolute. The Act recognises several situations where a Data Fiduciary can legitimately refuse or limit a request. Understanding these limitations helps you set realistic expectations:
Legal Retention Obligations
The right to erasure does not apply where retention is required by other laws � e.g., Income Tax records, RBI KYC data, or court orders.
State Functions
Some rights may be limited where data processing is for state functions, national security, or public interest.
Research and Statistics
Data processing for research, archiving, or statistical purposes may be exempt from certain rights where safeguards exist.
Legal Claims
Data may be retained where necessary for the establishment, exercise, or defence of legal claims.
Rights of Others
Your rights cannot be exercised in a way that harms the rights of other individuals or the public interest.
Are you a business owner?
As a Data Fiduciary, the law requires you to build systems that respect these rights. Failure to provide these rights to your users can lead to penalties of up to ?50 crore for general non-compliance, and up to ?250 crore for data breaches. Ensure your organisation is fully compliant.
- Implement a proper grievance redressal mechanism with a named officer
- Enable easy data access, correction, and erasure workflows
- Build data portability features into your products
- Make consent withdrawal as easy as giving consent
Common Scenarios: How Rights Apply
Here are some common situations where Data Principals exercise their rights:
You want to know what a social media platform knows about you
Applies: Right to AccessSubmit a data access request to the platform's grievance officer. You can ask for a summary of your data, purposes of processing, and third parties with whom it is shared.
You find inaccurate information in your bank records
Applies: Right to CorrectionNotify the bank in writing, provide proof of the correct information, and request correction. If not corrected within a reasonable time, escalate to the RBI Ombudsman and the Data Protection Board.
You want an e-commerce app to delete your account and data
Applies: Right to ErasureRequest account deletion and data erasure. The company must delete your data unless retention is required by law (e.g., tax records).
You want to stop marketing calls from a company
Applies: Right to Withdraw ConsentWithdraw your consent using the same channel you used to give it (e.g., unsubscribe link, account settings). The company must stop processing immediately.
You are unhappy with how a company handled your complaint
Applies: Right to Grievance RedressalEscalate to the Data Protection Board. The Board can investigate and impose penalties on the company.
Shilpi Kulshrestha
Founder, BusinezExcellence | Corporate Law & Company Secretary Expert
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy governance, and AI compliance.
Frequently Asked Questions
What are the rights of a Data Principal under the DPDP Act 2023?+
The DPDP Act 2023 grants six core rights: (1) Right to Access information, (2) Right to Correction and Erasure, (3) Right to Grievance Redressal, (4) Right to Data Portability, (5) Right to Nominate, and (6) Right to Withdraw Consent.
How do I exercise my right to access under the DPDP Act?+
Submit a written request to the Data Fiduciary (the organisation processing your data) asking for a summary of your personal data, the purposes of processing, and the categories of data shared with third parties. You can escalate to the Data Protection Board if unsatisfied.
What is the right to erasure under the DPDP Act?+
The right to erasure (also known as the right to be forgotten) allows you to request deletion of your personal data once the purpose of processing is complete, or if you withdraw consent. However, erasure can be refused if retention is required by law or for legal proceedings.
Can I withdraw my consent after giving it?+
Yes. Under Section 6(4), you can withdraw your consent at any time. Once withdrawn, the Data Fiduciary must cease processing your data (unless another legal basis applies). The process to withdraw consent must be as easy as the process to give it.
What is the right to nominate under the DPDP Act?+
The right to nominate allows you to appoint another individual to exercise your data rights on your behalf in the event of your death or incapacity. This ensures your digital legacy is protected.
How do I file a complaint under the DPDP Act?+
First, file a grievance with the Data Fiduciary's Grievance Officer. If it is not resolved within the prescribed time, escalate to the Data Protection Board of India (DPB). The Board can investigate and impose penalties up to ?250 crore.
Are these rights available to everyone in India?+
Yes. The DPDP Act 2023 applies to all Data Principals � any individual whose personal data is processed digitally or in non-digital form subsequently digitised. However, some rights may be limited by other laws.
What if a company ignores my data rights request?+
If a Data Fiduciary ignores or delays your request, you can file a complaint with the Data Protection Board. The Board can impose penalties up to ?50 crore for general non-compliance. You can also approach consumer forums or courts.
Related Topics on Data Protection
Obligations of Fiduciaries
Learn what the law expects from businesses.
Data Protection Board
Where you can escalate unresolved complaints.
Penalties & Offences
What happens when rights are violated.
Data Rights Insights
Deep dive into how to enforce your rights.
DPDPA Complete Guide
End-to-end guide to the Act.
Lawful Processing
When data can be processed in the first place.
Know your rights. Protect your data.
Understand your rights, exercise them confidently, and escalate when organisations fail to comply. The Data Protection Board is there to help.
Disclaimer: This page is for educational and informational purposes only. It is not legal advice. For advice on your specific situation, consult a qualified legal professional.