The DPDP Act 2023 gives Data Principals four core rights under Sections 11 to 14: the right to access information about their personal data (S.11), the right to correction and erasure (S.12), the right of grievance redressal (S.13), and the right to nominate someone to exercise their rights in the event of death or incapacity (S.14). A data fiduciary must have a working process to honour each of these. This guide takes the specific right being exercised and your current readiness, then gives a verdict and the concrete steps to respond correctly.
Pick which right is being exercised and how ready you are today. Get a straight verdict and the exact steps to respond correctly under the DPDP Act.
The DPDP Act 2023 gives every individual whose personal data is processed a set of enforceable rights. Section 11 covers the right to obtain a summary of the personal data being processed and the entities it has been shared with. Section 12 covers correction, completion, updating and erasure. Section 13 gives a right to grievance redressal through the fiduciary's Grievance Officer, and Section 14 lets a Data Principal nominate another person to exercise these rights in the event of death or incapacity.
These are not abstract entitlements — each one implies an operational capability the fiduciary must actually build. You cannot honour an access request without a data map, cannot honour erasure without knowing your retention obligations, and cannot honour grievance redressal without a functioning, published Grievance Officer. The gap most Indian companies discover is that they have the intent but not the plumbing.
A defensible response follows the same spine every time: recognise the request, verify identity, locate the data, act on the specific right, respond in writing and keep the record. The failure points are almost always operational — a request that arrives on the wrong channel and is never logged, or a correction that is made in one system but not the four others holding the same field.
Niti Bharat helps mid-market companies stand up a single rights-handling workflow that covers all four DPDP rights, wired to a real data map and a named owner. As a fixed-price engagement it replaces ad-hoc scrambling with a process a Data Protection Board would recognise as compliant, ahead of the expected May 2027 enforcement date.
Response templates for each of the four DPDP rights, an identity-verification checklist and a grievance-escalation flow you can adopt straight away.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
