DPDPA grants data principals five core rights: access, correction, erasure, grievance redressal, and nomination. Organisations must establish intake mechanisms, response workflows, and tracking systems ensuring timely compliance. This article examines each right, response timelines, and operational implementation.
Right of Access
Data principals may request confirmation of processing, categories of personal data held, identities of third-party recipients, and other prescribed information. Response must be in clear, plain language accessible to the requestor. Complex data inventories must be translated into comprehensible summaries within prescribed timelines.
Key Points
- Processing confirmation
- Personal data summary
- Recipient disclosures
- Plain language requirement
Correction and Erasure
Upon request, organisations must correct inaccurate data, complete incomplete data, update outdated data, and erase data no longer necessary for stated purpose. Erasure obligations are subject to retention requirements under other laws—the organisation must document applicable retention periods and communicate exceptions to requestors.
Grievance Redressal
Section 13 requires Data Fiduciaries to establish grievance redressal mechanisms. Complaints must be resolved within 90 days. If unresolved, data principals may approach the Data Protection Board. Organisations must designate grievance officers, publish contact details, and maintain complaint registers demonstrating timely resolution.
Key Points
- 90-day resolution timeline
- Designated grievance officer
- Published contact details
- Complaint register maintenance
Nomination Rights
Section 14 permits data principals to nominate representatives to exercise rights in case of death or incapacity. Organisations must establish nomination registration mechanisms and verify nominee identity before responding to posthumous or incapacity-triggered requests. Clear procedures prevent fraudulent nominee claims.
Key Takeaways
Create dedicated rights request intake channel
Implement ticketing system with SLA tracking
Design identity verification workflow
Map data locations for response compilation
Establish escalation protocols for complex requests