Data Principal rights and duties

DPDP — not yet effective

Act sections 11–15 and Rules 13–14 are scheduled for 13 May 2027.

Exact rights

The Act provides rights to:

• obtain a summary of personal data being processed and processing activities, plus prescribed identities of other Fiduciaries/Processors with whom data was shared and a description of data;
• correction, completion and updating;
• erasure subject to retention required for the specified purpose or compliance with law;
• grievance redressal;
• nominate one or more individuals to exercise rights in the event of death or incapacity.

It does not create a general GDPR-style portability right. A customer export is a product/vendor exit feature; a secure rights response is governed by the Indian provision and configured facts.

Identity assurance

Rule 14 refers to authentication using terms of service or another route. The product minimises new PII by first matching an existing authenticated account or subject reference. Step-up is proportionate to disclosure risk. A person who cannot use the digital route receives an assisted path; Aadhaar is never the universal default.

Identity states:

stateDiagram-v2
  [*] --> Submitted
  Submitted --> Matched: existing account/reference
  Submitted --> NeedsEvidence: insufficient match
  NeedsEvidence --> Matched: reviewed evidence
  NeedsEvidence --> Rejected: failed/abusive
  Matched --> StepUp: disclosure risk
  StepUp --> Verified: passed
  StepUp --> ManualReview: unavailable/failed
  ManualReview --> Verified: maker-checker approval
  Verified --> [*]
  Rejected --> [*]

Case lifecycle

submitted → identity_pending → triaged → in_fulfilment → review_pending → delivered → closed

Branches are clarification_requested, partially_fulfilled, refused, withdrawn and reopened. A refusal or partial result requires a source-linked reason, legal approval and clear grievance/escalation information. The system never auto-refuses solely because a connector failed.

Nomination

The record supports one or more nominees, the Principal’s instructions, verification state, revocation and a controlled activation event. Incapacity/death evidence, conflicts between nominees and exact precedence require customer policy and legal review. Nomination data is sensitive operational evidence and receives restricted access.

Data Principal duties

Section 15 requires the Principal to comply with applicable law, not impersonate, not suppress material information in specified document/evidence contexts, not register false or frivolous grievances/complaints, and furnish authentic information when exercising correction/erasure.

These duties are not a licence for hostile UX. Abuse controls use rate limits, duplicate detection, risk review and documented decisions. The portal still provides accessible intake and an escalation path.

Acceptance tests

• Given a Principal asks for “all portable data,” when triaged, then the response explains the applicable access-information right and does not invent a portability entitlement.
• Given a bank must retain a transaction record, when erasure is approved for marketing data, then marketing copies delete while the held record and reason remain visible.
• Given the primary connector is offline, when a deadline approaches, then a manual fulfilment task and escalation open; the case is not marked complete.
• Given identity evidence fails, when an agent overrides, then a second approver and reason are required.