Right to Access Information
LawSection 11 gives a Data Principal the right to obtain a summary of the personal data being processed about them and the processing activities undertaken on it, along with the identities of any other Data Fiduciaries or Processors that data has been shared with, and any other information prescribed by the Rules. In practice, this means being able to answer "what do you hold on me, and who have you given it to" in a way that's actually accurate — which depends entirely on having a working data inventory (Chapter 07).
Right to Correction and Erasure
LawSection 12 lets a Data Principal request correction of inaccurate or misleading data, completion of incomplete data, updating of data, and erasure of data that's no longer necessary for the purpose it was collected for — unless retention is otherwise required by law. This right is where Chapter 08 and this chapter meet directly: an erasure request is only straightforward to honour if you already know which systems hold the data in question and whether any of them have an independent legal reason to keep it.
Right of Grievance Redressal
LawSection 13 gives a Data Principal the right to have their grievance addressed by the Fiduciary, which is required under Section 8(10) to maintain an effective mechanism for this. Only once a grievance has gone through that mechanism (or gone unaddressed within a reasonable time) does escalation to the Data Protection Board become the next step — the internal mechanism isn't optional window-dressing, it's a genuine first line that most complaints should never need to go past.
Right to Nominate
LawSection 14 lets a Data Principal nominate another individual to exercise their rights in the event of death or incapacity — a provision with no close GDPR equivalent, reflecting a genuinely India-specific design choice. Few organisations have built a working process for this yet, since it's rarely tested in practice, but it's worth having a plan for at least how such a request would be verified and actioned once one arrives.
Withdrawal of Consent
Withdrawal is technically a consent mechanism under Section 6 rather than one of the four rights listed above, but it functions as a right in practice — a Data Principal exercising control over their own data. It's covered in full in Chapter 04.2, Consent Withdrawal, since it's substantial enough to warrant its own chapter.
Duties of Data Principal
LawRights come with correlative duties under Section 15: not impersonating another person when providing data, not suppressing material information when providing documents, not registering a false or frivolous grievance or complaint, and furnishing only verifiably authentic information when exercising a right. This is a genuine two-way structure — a Fiduciary that suspects a rights request is fraudulent or made in bad faith isn't left without any recourse.
Exercising Rights in Practice
| Step | What it requires |
|---|---|
| Identity verification | Confirming the requester is who they claim to be, proportionate to the sensitivity of the data involved |
| Locating the data | Searching across every system the data inventory (Chapter 07) says might hold it |
| Applying the right | Correcting, erasing, or compiling a summary, as requested |
| Responding within SLA | A published, consistently honoured timeframe — not an open-ended "we'll get to it" |
Routing every rights request to a general support inbox with no defined process, identity-verification step, or SLA. This tends to work fine for the first handful of requests and then quietly breaks down — inconsistent handling, missed deadlines, and no record of what was actually done — exactly when volume starts to matter.
Organisation's Responsibilities
PracticeBeyond the specific rights above, an organisation needs a published way for a Data Principal to actually reach it (the business contact information required under Section 8(9)), a documented internal process for handling each right consistently, and a record of requests received and how they were resolved — partly for the Data Principal's benefit, and partly as your own evidence of a functioning programme if a complaint is ever escalated to the Board.