Module 3: Rights & Duties of Data Principals
The four rights in Sections 11 to 14, the duties in Section 15, and a practical workflow for handling requests. This DPDPA 2023 course page explains rights and duties of data principals in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
Module 3 lessons (about 4 hours) (rights and duties of data principals)
Read the lessons in order, like chapters of a book. Each has reading, a click-through diagram, an activity and a quiz.
What you will learn about rights and duties of data principals
- List the rights granted by the Act
- Distinguish them from GDPR-style rights that DPDPA does not grant
- Design a simple request-handling workflow
- Explain the duties of Data Principals
The rights
Sections 11 to 14 give four rights.
- Access: a summary of personal data processed, the processing activities, and the identities of other fiduciaries and processors it was shared with
- Correction, completion and updating of data
- Erasure, unless retention is needed for the specified purpose or by law
- Grievance redressal: approach the fiduciary first, the Board only afterwards
- Nomination: name someone to exercise rights in case of death or incapacity
What DPDPA does not include (rights and duties of data principals)
There is no standalone right to data portability, to restrict processing, or to object to automated decisions. Do not copy GDPR checklists blindly; align to the Act and the Rules.
Duties of the Data Principal
Section 15 expects principals to comply with laws, avoid impersonation, avoid suppressing material information, avoid false or frivolous grievances, and furnish only verifiably authentic information. Breach can attract a penalty up to ₹10,000.
A request workflow that works (rights and duties of data principals)
Receive the request, verify identity, locate data across systems, decide and apply any lawful exception, respond, and log everything. The Rules set a maximum period for grievance response (90 days at the time of writing), so aim far below it.
Build one intake channel, one log and one owner for rights requests before the Rules take full effect.
Check your understanding of rights and duties of data principals
Q1. Which of these is NOT a right under Sections 11 to 14?
Q2. Where should a Data Principal take a grievance first?
Q3. Maximum penalty for a Data Principal breaching their duties?
Quick FAQs
Can a company refuse erasure?
Yes, where retention is necessary for the stated purpose or required by law.
Is a fee allowed for requests?
The Act is silent; treat requests as free unless the Rules or sectoral law say otherwise.
Do it yourself: practical guides (rights and duties of data principals)
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.