Right to access information (Section 11)
On request, a Data Principal is entitled to a summary of the personal data being processed and the processing activities, the identities of other Data Fiduciaries and Data Processors with whom the data has been shared along with a description of what was shared, and any other prescribed information. The right applies to personal data processed on the basis of the individual’s consent, or on a legitimate use that they enabled.
Right to correction and erasure (Section 12)
A Data Principal may request correction of inaccurate or misleading data, completion of incomplete data, updating of data, and erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law.
This is where the "right to be forgotten" sits in Indian law. The DPDPA does not use that phrase. The effect is delivered through erasure under Section 12, read with the Data Fiduciary’s own duty under Section 8(7) to erase personal data once consent is withdrawn or the purpose is served, unless a legal retention applies.
Grievance redressal and nomination (Sections 13 and 14)
Section 13 gives the right to a readily available means of grievance redressal and requires the Data Fiduciary or Consent Manager to respond within the prescribed period. The grievance route must be used before approaching the Board.
Section 14 gives the right to nominate another individual who may exercise the Data Principal’s rights in the event of death or incapacity. This is a feature of the Indian Act that several overseas regimes do not have.
What the DPDPA does not grant
It is as important to know what the Act does not give, because assumptions carried over from other regimes lead to the wrong design. The DPDPA does not contain:
- No standalone right to data portability of the kind in the EU GDPR. The right to access under Section 11 is an information right, not a portability right.
- No separate, named "right to be forgotten"; erasure under Section 12 and Section 8(7) is the mechanism.
- No specific right against automated decision-making or profiling of the kind in the GDPR.
- Section 15 imposes duties on the Data Principal, including not to register a false or frivolous complaint; a breach of these duties can attract a penalty of up to the amount set in the Schedule.
How AMLEGALS helps organisations handle rights
AMLEGALS is an Indian law firm. Its data privacy practice is led by Anandaday Misshra, Founder and Managing Partner, with Rohit Lalwani, Associate Partner, working on DPDPA compliance.
The team builds the request workflow, the verification step, the response templates and the evidence trail, so an organisation can meet Sections 11 to 14 within the timelines set by the Rules.