Honouring Data Principal Rights: Operationalising DPDPA Sections 11-14

As of July 2026, the Digital Personal Data Protection Act, 2023 (DPDPA) and its accompanying Rules are fully operational, ushering in a new era for data privacy in India. At the heart of this framework are the rights accorded to data principals, enshrined primarily in Sections 11 through 14 of the DPDPA. For Indian companies, moving beyond mere awareness to establishing practical, robust workflows to honour these rights is no longer optional; it’s a legal imperative and a cornerstone of building trust. This analysis delves into the operational aspects of enabling these crucial data principal rights, integrating the DPDPA’s mandates with India’s diverse sectoral regulatory landscape.

Laying the Groundwork: Understanding and Enabling Rights (DPDPA Sections 11 & 12)

Sections 11 and 12 of the DPDPA establish the core rights of data principals and the corresponding duties of data fiduciaries. Data principals are empowered with the right to obtain information about their personal data (S.11(1)(a)), seek correction and erasure (S.11(1)(b)), avail a grievance redressal mechanism (S.11(1)(c)), and nominate an individual to exercise these rights in specific circumstances (S.11(1)(d)). Critically, Section 12 places a clear obligation on data fiduciaries to facilitate the exercise of these rights through easily accessible and transparent means.

For Indian businesses, this means proactively designing systems, not just reacting to requests. Workflows must begin with identifying all personal data processed, its purpose, and its lifecycle. Unlike the GDPR’s broader “right to be forgotten,” the DPDPA’s right to erasure (S.11(1)(b), S.13) is more focused on data that is no longer necessary for the purpose for which it was collected or retained, or where consent is withdrawn. This nuanced approach requires fiduciaries to clearly define data retention policies aligned with business needs and legal obligations, rather than simply deleting upon request.

Operationalising Access, Correction, and Erasure (DPDPA Section 13)

The practical implementation of data access, correction, and erasure requests demands meticulous planning and execution.

Right to Information (S.11(1)(a)): Data fiduciaries must provide data principals with a summary of their personal data, details of processing activities, and the identities of other data fiduciaries or data processors with whom the data has been shared.

• Workflow: Companies should establish a dedicated, secure portal or an email channel for data principal requests. Upon receiving a request, a verification process (e.g., OTP-based authentication, KYC checks) is paramount to confirm the identity of the data principal. Once verified, the fiduciary must compile the requested information, ensuring it is presented in an intelligible format, within the timelines prescribed by the DPDP Rules. This often necessitates mapping data flows across various internal systems and third-party integrations.

Right to Correction and Erasure (S.11(1)(b), S.13): Data principals can request correction of inaccurate or misleading data, or the erasure of data no longer necessary for its original purpose.

• Workflow: Similar to access requests, these requests require identity verification. Following verification, the fiduciary must implement an internal process to update or delete the data across all relevant databases and systems. Section 13(3) mandates that the fiduciary must also inform all relevant third-party data fiduciaries or data processors to whom the data was shared about the correction or erasure. This highlights the need for robust data sharing agreements and clear communication protocols with vendors.
• Challenges & Sectoral Overlays: Data retention obligations imposed by sectoral regulators can impact erasure requests. For instance, RBI’s norms for financial institutions often mandate specific data retention periods for transaction records, while SEBI regulations require market intermediaries to maintain records for several years. In such cases, Section 13(4) clarifies that the right to erasure does not apply where data retention is necessary for legal compliance. Companies must clearly communicate these limitations to data principals, citing the relevant legal basis.

Building a Robust Grievance Redressal Mechanism (DPDPA Section 14)

A well-defined grievance redressal mechanism is a cornerstone of DPDPA compliance. Section 14 mandates that every data fiduciary must establish an accessible mechanism to address data principal grievances. This includes appointing a Data Protection Officer (DPO) or a designated individual to serve as the primary point of contact (S.14(1)).

• Workflow: The grievance redressal process should be clearly articulated on the company’s website and privacy policy. It must outline the steps for lodging a complaint, expected response times (as per DPDP Rules), and internal escalation paths. Before approaching the Data Protection Board of India (DPBI), data principals are generally expected to exhaust the fiduciary’s internal grievance redressal process.
• Integration with Sectoral Mechanisms: Indian companies, especially those in regulated sectors, must integrate DPDPA grievance mechanisms with existing frameworks. For instance, financial service providers under RBI’s purview already have customer service and ombudsman schemes. Similarly, SEBI-regulated entities leverage platforms like SCORES for investor grievances, and IRDAI has specific policyholder protection regulations. The DPDPA mechanism should complement, not conflict with, these existing structures, ensuring a seamless experience for the data principal while adhering to all regulatory mandates. For intermediaries under the IT Rules, 2021, the DPDPA grievance officer role can be integrated with the existing grievance officer requirements, streamlining compliance.

Practical Takeaway

For Indian businesses, General Counsel, and Data Protection Officers, honouring data principal rights under DPDPA Sections 11-14 requires a strategic, multi-faceted approach. Begin by conducting a thorough data mapping exercise to understand what personal data you hold, why, and where. Develop clear, documented policies and procedures for handling access, correction, and erasure requests, ensuring these are communicated transparently to data principals. Invest in secure, user-friendly technological solutions for request submission and identity verification. Crucially, train your staff comprehensively on these new workflows and the importance of data principal rights. Finally, integrate DPDPA compliance with existing sectoral regulatory requirements, ensuring a harmonised and efficient approach to data governance. Proactive compliance is not just about avoiding penalties; it’s about fostering trust and demonstrating a commitment to responsible data stewardship in India’s digital economy.