Lesson 3.7: Duties of the Data Principal and handling misuse
Rights are balanced by duties. Learn how to deal with false or repeated requests fairly. This DPDPA 2023 course page explains duties of the data principal in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about duties of the data principal
- List the Section 15 duties
- Spot misuse of the rights process
- Reject a request properly
Section 15 (duties of the data principal)
A Data Principal must comply with law, not impersonate, not suppress material information when providing documents or IDs, not file false or frivolous grievances, and furnish only verifiable and authentic information when exercising rights. Breach can lead to a penalty up to Rs 10,000.
Misuse check
Select a numbered box to read more.
Do and do not (duties of the data principal)
| Do | Do not |
|---|---|
| Explain refusal in writing | Refuse silently |
| Offer to re-submit with proof | Accuse the person |
| Keep a record | Delete the record |
Worked example
A person sends the same erasure request six times under different names. The company asks for proof, gets none, and replies in writing that it cannot act.
Activity (5 minutes) (duties of the data principal)
Write two standard replies: one asking for proof of identity and one rejecting a false claim.
Check your understanding of duties of the data principal
Q1. Penalty for breaching Data Principal duties can be up to:
Q2. Impersonating another person is:
Q3. You should refuse a request:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.