India's DPDP Act 2023 gives every individual — every data principal — seven powerful rights over their personal data. As a Data Fiduciary, you must have systems to receive, verify, and fulfil these rights requests. Failure to do so risks penalties up to ₹150 crore and direct DPB intervention.
Sections §11 through §14 of the DPDP Act grant every data principal — every individual whose personal data is processed — seven enforceable rights against every Data Fiduciary.
Every data principal has the right to obtain a summary of their personal data being processed by a Data Fiduciary — including the categories of data held, the purposes for which it is processed, and any third parties it has been shared with.
Every data principal has the right to correct inaccurate or misleading personal data and to complete incomplete personal data held by the Data Fiduciary. This includes correcting data across all systems, processors, and third parties it has been shared with.
Every data principal has the right to have their personal data erased — when it is no longer necessary for the purpose for which it was collected, or when they withdraw consent and there is no overriding legal ground for continued processing. Erasure must extend to all processors and shared parties.
Every data principal has the right to receive a copy of their personal data in a structured, commonly used, machine-readable format — and to transmit that data to another Data Fiduciary where technically feasible. This enables individuals to switch service providers without losing their data history.
Every data principal has the right to withdraw consent at any time — without any detriment to them. Withdrawal must be as easy as the original grant. Upon withdrawal, processing for that purpose must cease and the data must be erased unless another legal basis applies.
Every data principal has the right to nominate another individual to exercise their DPDP rights on their behalf in the event of their death or incapacity. This is a unique DPDP provision — creating a digital succession right for personal data. Data Fiduciaries must honour nominations registered with them.
Every data principal has the right to an effective grievance redressal mechanism — the right to complain to the Data Fiduciary and receive a response. If unsatisfied, they can escalate to the Data Protection Board (DPB). Data Fiduciaries must publish contact details for their Grievance Officer (or DPO for SDFs) and respond to complaints within 30 days.
Precise timelines, actions, and penalties for every data principal right — know exactly what is required before a request arrives.
| Right | DPDP Section | Response Deadline | Required Action | Max Penalty if Refused |
|---|---|---|---|---|
| Access to personal data summary | §11 | 30 Days | Provide written summary of data held, purposes, and third-party disclosures | ₹150 Crore |
| Correction of inaccurate data | §12 | 30 Days | Update data across all systems and notify all processors of correction | ₹150 Crore |
| Completion of incomplete data | §12 | 30 Days | Complete the record and update all processors accordingly | ₹150 Crore |
| Erasure of personal data | §12 | 30 Days | Delete from all systems; instruct all processors; provide deletion certificate | ₹150 Crore |
| Data portability / export | §12 | 30 Days | Provide structured, machine-readable export of data; transmit if requested | ₹150 Crore |
| Consent withdrawal | §6(6) | Immediate | Cease processing for withdrawn purpose; trigger erasure unless legal basis applies | ₹200 Crore |
| Nominee registration | §14 | 30 Days | Register nominee; on death/incapacity grant nominee rights access | ₹150 Crore |
| Grievance redressal | §13 | 30 Days | Acknowledge within 48 hrs; substantive written response within 30 days | ₹50 Crore |
A Data Subject Access Request (DSAR) under the DPDP Act must follow a structured process to ensure timely, accurate, and documented fulfilment. Here is the complete workflow.
Before a DSAR arrives, these 18 organisational prerequisites must be in place. Most organisations discover significant gaps when they check for the first time.
KavachOne's Rights Portal gives your data principals a branded self-service experience for all 7 DPDP rights — while automating intake, routing, deadline tracking, and fulfilment workflows behind the scenes.
KavachOne's Rights Portal and Privacy Suite give your data principals a seamless rights experience — while automating every DSAR intake, verification, routing, and deadline workflow behind the scenes, integrated with your ROPA and ConsentiQo.
