Rights of Data Principals

Chapter III of the DPDPA enshrines a set of rights that empower individuals (Data Principals) with control over their personal data. These rights form the counterbalance to the obligations imposed on Data Fiduciaries and are central to the Act's objective of protecting informational privacy. The rights under the DPDPA are broadly analogous to those under the GDPR but are tailored to the Indian context and are fewer in number. Notably, the DPDPA does not include a right to data portability or a right to object to processing - distinguishing it from European frameworks.

Every Data Principal has the right to obtain from the Data Fiduciary: • A summary of personal data being processed and the processing activities undertaken • The identities of all Data Fiduciaries and Data Processors with whom the personal data has been shared, along with a description of the data shared • Any other information as may be prescribed This right ensures transparency and allows individuals to understand the full landscape of how their data is being used. Unlike the GDPR's detailed access right, the DPDPA frames this as a right to a "summary" rather than a copy of the data itself. Data Fiduciaries must respond to such requests within the timelines prescribed under the Rules. Failure to provide information can be escalated through the grievance redressal mechanism.

Data Principals have the right to: • Correct inaccurate or misleading personal data • Complete incomplete personal data • Update personal data that is no longer current • Erase personal data that is no longer necessary for the purpose for which it was collected The Data Fiduciary must action the correction or erasure and also direct any Data Processors to do the same. Where the Fiduciary has shared the data with another Fiduciary, the obligation extends to notifying the receiving Fiduciary of the correction or erasure. This right is not absolute - it is subject to the requirement of compliance with any law for the time being in force. If a law requires the Fiduciary to retain certain data, the erasure request may be declined with appropriate justification.

Every Data Fiduciary must establish a grievance redressal mechanism and publish the details of a Grievance Officer. The Data Principal may: 1. Submit a complaint to the Grievance Officer of the Data Fiduciary 2. If unsatisfied with the response (or if no response is received within the prescribed period), escalate to the Data Protection Board of India The Rules prescribe specific timelines for acknowledgment and resolution of grievances. This two-tier mechanism - internal resolution followed by Board escalation - is designed to filter complaints and encourage resolution at the organisational level before involving the regulator. The Grievance Officer must be clearly identified and accessible, and the grievance mechanism must be available through the same medium through which the consent was obtained.

A unique feature of the DPDPA, the nomination right allows a Data Principal to nominate any individual to exercise their rights in the event of: • The Data Principal's death • The Data Principal's incapacity The nominee steps into the shoes of the Data Principal and can exercise all rights under the Act. This provision addresses a gap that exists in many international frameworks and has practical significance for digital estate planning. The procedure for making and registering nominations is to be prescribed under the Rules.

Uniquely, the DPDPA also prescribes duties for Data Principals, including: • Complying with all applicable laws while exercising rights • Not registering false or frivolous complaints with the Board • Not providing false or misleading information when exercising rights • Not suppressing material information when providing personal data • Not impersonating another person when providing personal data Breach of these duties can attract a penalty of up to Rs 10,000. This reciprocal obligation framework is unusual globally and reflects the Act's attempt to create a balanced ecosystem.