Sekurzen Logo
DPDP chapter6 / 14

Chapter 6: Manner of Exercising Rights

Data principal rights procedures

chapter · 2 min read · Updated 14-Feb-2026 · 6 of 14

Executive Summary

  • •You have the right to ask "What do you know about me?", "Fix it", or "Delete it". Companies must have a clear door for these requests and answer them quickly.

Institutional Impact

  • •The Request Portal: You need a designated channel (email, form) for these requests.
  • •Published process: State how a Data Principal can submit a request and what identifying particulars are required.
  • •Grievance period: Publish a reasonable grievance-response period that does not exceed 90 days.
  • •Verification: You must verify the identity of the person asking before handing over data (to prevent data leaks via access requests!).

Data Principal Rights

  • •Right to Know: You can ask for a summary of all personal data they hold and who they shared it with.
  • •Right to Correct: Changed your name or address? They must update it.
  • •Right to Erase: You can ask them to forget you (unless they need the data for legal reasons).

Practical application

What this looks like in practice

Use these examples to distinguish a defensible process from a common mistake.

Right

  • ✓A company provides a clear request channel, verifies the requester, and records how the request was resolved.

Incorrect

  • ×A company ignores a rights request or releases personal data without checking who submitted it.

Official Reference & Scope

  • •Sections 11-13: Access, correction, erasure, and grievance redressal
  • •Rule 14: Rights of Data Principals

Specifies how Data Principals can exercise their rights under the DPDP Act.

  • Right to access: Requesting information about personal data processing
  • Right to correction: Updating inaccurate or incomplete data
  • Right to erasure: Requesting deletion of personal data
  • Response timelines: Timeframes for Data Fiduciary responses

Rule 14 does not impose a universal 30-day period for every rights request. It requires the request mechanism and identifying particulars to be published and requires a grievance-response period not exceeding 90 days.

Primary sources: sections 11-13 of the DPDP Act and rule 14 of the DPDP Rules.

Back to list
Chapter 5: Verifiable Consent and ChildrenNext: Chapter 7: Retention and Erasure