Lesson 3.2: Right to information

Module 3 · Lesson 3.2 of 8 · About 30 minutes · Right to information

Section 11 lets a person ask what you hold and what you do with it. This DPDPA 2023 course page explains right to information in plain language.

right to information - DPDPA 2023 course lesson banner

What you will learn about right to information

State what the information right covers
Know what you must provide
Design a response template

What Section 11 covers (right to information)

On request, a person whose consent was given or who relies on voluntary provision can ask for a summary of the personal data being processed, the processing activities, and the identities of all other fiduciaries and processors with whom the data has been shared, with a description of the data shared. Any other information related to the data and its processing can be asked as prescribed.

Handling an information request: click each step

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

What to include in the response (right to information)

Item	Example
Summary of data	Name, phone, address, order history
Processing activities	Order fulfilment, newsletters
Others shared with	Courier, payment gateway, SMS vendor
Description of data shared	Name and address only to the courier

Worked example

A user of a delivery app requests information. The app returns a one-page summary listing the data fields, three purposes, and four vendors with what each received.

Activity (5 minutes) (right to information)

Create a one-page template with the four items above and keep it ready.

Key takeaway: You cannot answer this right unless you know where data flows. A data inventory is the foundation.

Check your understanding of right to information

Q1. A response to an information request should include:

Q2. First step when a request arrives?

Q3. Who must information include?

← Rights overview: what a Data Principal can ask for Right to correction, completion and updating →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for right to information: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.