Explore all statutory rights guaranteed to citizens under Chapter III of the DPDP Act 2023, including exact operational fulfillment steps and statutory obligations for Data Fiduciaries.
Obtain a summary of personal data processed and identities of all shared Data Processors.
Correct inaccurate data, update information, and erase data when purpose is served.
Access readily available grievance redressal with right to escalate to the Data Protection Board.
Designate a nominee upon death/incapacity, and withdraw consent with ease at any time.
Under Section 11, the Data Principal has the right to request a summary of personal data being processed, identity of all other Data Fiduciaries and Data Processors with whom data has been shared, and any other prescribed information.
Section 11(1): The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent or in respect of certain legitimate uses, a summary of personal data being processed and the processing activities undertaken.
The Digital Personal Data Protection (DPDP) Act, 2023, is fundamentally designed to empower the individual. In the digital age, where personal data is the currency of the global economy, the balance of power has historically tilted heavily toward the massive corporations and organizations that collect and process this data. The DPDP Act seeks to correct this imbalance by granting individualsΓÇölegally termed "Data Principals"ΓÇöa robust suite of actionable rights. These rights are not mere philosophical concepts; they are legally enforceable mechanisms that allow individuals to reclaim control over their digital footprint, demand transparency, and enforce accountability upon Data Fiduciaries. This comprehensive guide details the rights guaranteed to you under the Act and explains the practical mechanisms for exercising them.
Before exploring the specific rights, it is necessary to establish who possesses them. Section 2 of the DPDP Act defines a "Data Principal" as the individual to whom the personal data relates. If a company collects your name, email address, shopping history, or location data, you are the Data Principal in relation to that specific dataset. Crucially, the Act extends this definition in two important ways: where such individual is a child (under 18 years of age), the term includes the parents or lawful guardian of such a child; and where the individual is a person with a disability, it includes their lawful guardian acting on their behalf. This ensures that vulnerable populations are equally protected under the law and have authorized representatives to exercise rights on their behalf.
Transparency is the cornerstone of data protection. You cannot protect your data if you do not know who holds it or what they are doing with it. Section 11 of the Act guarantees your Right to Access Information about personal data. If you have previously given consent to a Data Fiduciary to process your data, you have the right to request and obtain from them:
Practical Application: If you suspect a social media platform is hoarding excessive data about you or selling it to obscure data brokers, you can exercise this right. The Fiduciary is legally obligated to respond with a clear, comprehensible summary. However, note that this right is primarily applicable when data is processed based on your consent, and may not fully apply when data is processed under "Certain Legitimate Uses" (like State functions or medical emergencies) where providing such summaries could impede vital services or legal processes.
Data is only useful when it is accurate, and it should only be retained as long as it is necessary. Section 12 empowers you to maintain the hygiene of your digital profile through the rights of correction, completion, updating, and erasure.
If a Data Fiduciary holds inaccurate or misleading personal data about you (for example, a credit reporting agency holds an incorrect address or a false record of a defaulted loan), you have the right to request its correction. You also have the right to demand the completion of incomplete personal data and the updating of outdated personal data. Upon receiving such a request, the Data Fiduciary is legally bound to rectify the inaccuracy.
Perhaps one of the most powerful tools in the Act is the right to erasure. You have the right to request that a Data Fiduciary erase your personal data that is no longer necessary for the purpose for which it was processed. If you delete your account on an e-commerce platform, that platform generally has no further legitimate purpose for retaining your purchase history and browsing habits. Upon your request, the Fiduciary must erase your data and ensure that any Data Processors they hired also erase it.
Limitations on Erasure: This right is not absolute. A Fiduciary can refuse an erasure request if the retention of that specific personal data is necessary for compliance with any law for the time being in force. For instance, a bank cannot erase your transaction history upon your request if financial regulations require them to maintain those records for seven years to prevent money laundering.
Rights are meaningless without a mechanism to enforce them. Section 13 guarantees your Right of Grievance Redressal. This establishes a two-tiered system for resolving disputes and complaints regarding your data.
The Act mandates that every Data Fiduciary must establish a readily available means of grievance redressal. If you believe your rights have been violated (e.g., your erasure request was ignored, or you suffered a data breach), your first recourse is to contact the Fiduciary. They are required to respond to your grievance within a period prescribed by the government.
If the Data Fiduciary fails to respond within the prescribed time, or if you are unsatisfied with their response, you are not left without options. You have the right to escalate the matter by registering a formal complaint with the Data Protection Board of India. The Board acts as an independent regulatory body with the power to investigate complaints, summon witnesses, conduct hearings, and levy substantial financial penalties against non-compliant Fiduciaries.
Important Procedural Note: The Act strongly encourages the exhaustion of internal remedies. A Data Principal should generally attempt to resolve the issue with the Data Fiduciary's grievance mechanism before approaching the Board, ensuring that the regulatory body is not overwhelmed with easily resolvable disputes.
In a unique and progressive addition to data protection law, the DPDP Act introduces the concept of post-mortem digital privacy. Under Section 14, every Data Principal possesses the Right to Nominate. You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights under the Act on your behalf.
This addresses a significant modern challenge: what happens to a person's digital assets, social media accounts, and private cloud storage when they pass away? By nominating a trusted individual (a digital executor of sorts), you ensure that someone has the legal authority to request the deletion of your accounts, access a summary of your data, or manage your digital legacy, preventing your personal information from remaining perpetually vulnerable in cyberspace.
With great power comes corresponding responsibility. To prevent the misuse of these newly granted rights and to ensure the smooth functioning of the digital ecosystem, Section 15 of the Act imposes specific, legally binding duties upon the Data Principal. The exercise of your rights is contingent upon your compliance with these duties.
Consequences of Breach of Duties: The duties of the Data Principal are not mere suggestions. The Act stipulates that if a Data Principal breaches any of these duties (such as filing a deliberately false complaint to extort a company), they may be subject to a financial penalty. The Schedule to the Act currently sets the maximum penalty for a breach in observance of the duties of a Data Principal at INR 10,000.
Understanding your rights is the first step; acting upon them is the second. Here is a general framework for exercising your DPDP Act rights:
The DPDP Act places the Data Principal at the center of the regulatory framework. By understanding and actively utilizing your rights to access, correct, erase, and grieve, you transition from being a passive subject of data harvesting to an active participant in your digital life. We encourage you to use our Data Principal Rights Navigator tool to map out specific legal paths and understand the precise statutory language that supports your demands for digital autonomy and privacy.
