They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
4 DATA PRINCIPAL RIGHTS
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineThe DPDP Act 2023 empowers individuals (Data Principals) with fundamental rights over their personal data. Organizations must implement mechanisms to honor these rights.
Four enforceable rights — access, correction & erasure, grievance redressal, and nomination — with corresponding duties under Section 15.
4Enforceable rights
S.11–15Chapter III coverage
1,000+Audits delivered
DPDP Act 2023 · Chapter III, Sections 11–15 · Last reviewed June 2026
Direct Answer
What rights do data principals have?
Under the DPDP Act 2023, a data principal — the individual a piece of personal data is about — has four enforceable rights: the right to access information about their data (Section 11), to correction and erasure (Section 12), to grievance redressal (Section 13), and of nomination (Section 14), with corresponding duties under Section 15. Data fiduciaries must build accessible mechanisms to honour these rights and respond within the period prescribed by the MeitY DPDP Rules 2025.
Key Takeaways
- Data principals have four rights: access (S.11), correction & erasure (S.12), grievance redressal (S.13), and nomination (S.14).
- Section 15 imposes duties — no impersonation, no suppression of material information, and no false or frivolous complaints.
- Unlike the GDPR, DPDP has no explicit right to data portability, to object, or against solely automated decisions.
- Data fiduciaries must provide accessible request and grievance mechanisms and respond within the period prescribed by Rule 14.
Chapter III
Fundamental Rights
Section 11
Right to Access Information
Data Principals have the right to obtain a summary of their personal data being processed and the processing activities.
- Summary of personal data being processed
- Identities of Data Fiduciaries and Data Processors
- Information about any data sharing with third parties
- Response within prescribed time period under Rule 14
Section 12
Right to Correction and Erasure
Data Principals can request correction of inaccurate or misleading data, completion of incomplete data, updating of data, and erasure of data.
- Correction of inaccurate or misleading personal data
- Completion of incomplete personal data
- Updating of personal data
- Erasure of personal data no longer necessary
Section 13
Right to Grievance Redressal
Data Principals have the right to readily available means of grievance redressal provided by the Data Fiduciary.
- Accessible grievance redressal mechanism
- Response within prescribed timeframe
- Escalation to Data Protection Board if unresolved
- Right to file complaint with the Board
Section 14
Right of Nomination
Data Principals can nominate another individual to exercise their rights in the event of their death or incapacity.
- Nominate any individual to exercise rights
- Applicable in case of death or incapacity
- Nominee can access, correct, or erase data
- Registration process as per prescribed rules
Section 15
Duties of the Data Principal
While Data Principals have rights, they also have corresponding duties to ensure responsible exercise of these rights.
- Comply with applicable laws while exercising rights
- Not impersonate another person while providing personal data
- Not suppress any material information while providing data
- Not register false or frivolous grievances or complaints
- Provide authentic and verifiable information when required
At a Glance
Data Principal Rights at a Glance
The complete set of rights and duties under Chapter III of the DPDP Act 2023.
| Section | Right / duty | What it covers |
|---|---|---|
| Section 11 | Right to access information | A summary of personal data processed, the processing activities, and the identities of fiduciaries and processors with whom data is shared |
| Section 12 | Right to correction & erasure | Correct inaccurate or misleading data, complete or update data, and erase data no longer needed for its purpose |
| Section 13 | Right to grievance redressal | A readily available grievance mechanism with the data fiduciary before approaching the Board |
| Section 14 | Right of nomination | Nominate another individual to exercise rights in the event of death or incapacity |
| Section 15 | Duties of the data principal | Exercise rights lawfully — no impersonation, no false or frivolous complaints, no suppression of material information |
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on data principal rights, response timelines, and duties.
Who is a data principal under the DPDP Act?
A data principal is the individual to whom the personal data relates — the equivalent of a data subject under the GDPR. Where the individual is a child, the data principal includes the parent or lawful guardian. Where the individual is a person with a disability, it includes their lawful guardian.
What rights do data principals have under the DPDP Act?
The DPDP Act 2023 gives data principals four rights: the right to access information about their personal data (Section 11), the right to correction and erasure (Section 12), the right to grievance redressal (Section 13), and the right of nomination (Section 14). Section 15 sets out corresponding duties, such as not filing false or frivolous complaints.
How quickly must a data fiduciary respond to a rights request?
A data fiduciary must respond within the time period prescribed by the DPDP Rules 2025 (Rule 14 addresses the timeframe for access, correction, and erasure requests). Organizations should build request-handling workflows with clear internal SLAs so they can meet the prescribed period and evidence compliance.
Does the DPDP Act include a right to data portability or to object?
No. Unlike the GDPR, the DPDP Act does not provide an explicit right to data portability, a right to object to processing, or rights against solely automated decision-making. Its rights set is narrower, centred on access, correction, erasure, grievance redressal, and nomination.
What is the right of nomination?
Section 14 lets a data principal nominate another individual to exercise their rights — for example, accessing, correcting, or erasing data — in the event of their death or incapacity. The nominee then steps into the data principal’s shoes for the nominated rights, following the process set out in the rules.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act and Rules 2025.
- DPDP compliance consulting in India — build compliant rights and grievance workflows.
- DPDP penalty calculator — quantify the cost of non-compliance.
- Tranquility Cybersecurity credentials & proof.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Consent Management
Lawful consent collection, withdrawal and record-keeping under the DPDP Act.
Read morePrivacy
DPDP vs GDPR
Side-by-side comparison for companies subject to both regimes.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
GDPR Compliance
The EU's data protection regulation for any company with EU users.
Read morePrivacy
DPDP Act Overview
India's Digital Personal Data Protection Act, explained.
Read moreDPDP course · Module 4 of 8
Previous · Module 33.9 Significant data fiduciaries and their extra dutiesCourse map8 modules · 79 lessons · 24 readyNext4.4 Personal data breaches: who you tell and when
Next in the course: 4.2 Answering a rights request in practice. Surendra Pal Singh is writing it.