Nomination Rights

Section 14 of the DPDPA allows a Data Principal to nominate any individual who shall, in the event of the Data Principal's death or incapacity, exercise the rights of the Data Principal under the Act. This is a distinctive feature of the DPDPA that addresses the question of what happens to personal data after an individual is no longer able to manage it. The nomination ensures continuity of data protection rights and enables a trusted individual to access, correct, erase, or otherwise manage the personal data of the deceased or incapacitated Data Principal.

The nominee can exercise all rights that the Data Principal could have exercised, including: (a) the right to access information about personal data processing; (b) the right to correction and erasure; (c) the right to withdraw consent; and (d) the right to grievance redressal. The nominee steps into the shoes of the Data Principal for the purpose of the Act. However, the nominee's rights are derivative - they exist only because of the nomination and are limited to managing the data of the nominating Data Principal.

Rule 14(4) of the DPDP Rules prescribes the manner of making a nomination. Data Fiduciaries will need to provide a mechanism for Data Principals to register nominations and for nominees to verify their status when exercising rights. The nomination may be revoked or changed by the Data Principal at any time during their lifetime. The process should be simple and accessible, consistent with the Act's emphasis on ease of exercising rights.

Organisations should consider: (a) creating a nomination registration mechanism within their user accounts or privacy portals; (b) establishing verification procedures for nominees claiming rights; (c) maintaining secure records of nominations; (d) handling conflicts between nominees and legal heirs; and (e) addressing situations where multiple services have different nominees. The interaction between nomination rights and inheritance law, digital estate planning, and succession laws presents novel legal questions that may require further guidance from the Board or courts.

The GDPR does not contain an explicit nomination provision, though Member States may provide for the exercise of data subjects' rights after death under national law. France's Loi Informatique et Libertés, for example, allows individuals to define directives regarding the fate of their data after death. India's approach of embedding nomination in the primary legislation (rather than leaving it to subsidiary or state-level law) provides a uniform national framework. This is particularly relevant given the increasing volume of digital assets and personal data held across multiple platforms.