General awareness
Most privacy notices list three rights. The Act gives four.
Most privacy notices describe Data Principal rights as a familiar short list. You can access your data, correct it, ask us to erase it, and raise a grievance. Fair enough, and then the section ends.
The Act gives a fourth right that the list almost always drops.
Nomination.
The right the list forgets to name
Under Section 14, a Data Principal may nominate another individual to exercise their rights on their behalf in the event of death or incapacity. It is not a courtesy. It is a statutory right, and Rule 3 requires the notice to tell people how to exercise their rights. A notice that never mentions nomination is not a shorter notice. It is an incomplete one.
The right they name but cannot deliver
That is the right people forget to name. There is a second one they name but cannot deliver.
Access, under Section 11, is wider than "a copy of my data". It has two limbs. The first is a summary of the personal data being processed and the processing activities. The second, the one systems trip over, is the identity of every other Data Fiduciary and Data Processor the data has been shared with, and a description of what was shared. Most organisations can pull an individual's record. Far fewer can reconstruct, on request, the full sharing map for that one person.
A nuance worth keeping straight: the access and correction rights attach to processing you carry out on consent, or on the Section 7(a) voluntary provision ground. Not every legitimate use triggers them. That does not shrink the duty where consent is your basis, which for most consumer facing processing it is.
The mental model
There are four rights, not two, and the two that get dropped are the two that cost something to honour. Nomination, which most notices never mention. And the sharing map limb of access, which most systems cannot produce.
The practical consequence follows directly. Two quiet builds sit behind these rights: a working nomination mechanism, named in your notice; and a way to answer, per individual, who we shared this person's data with. Listing a right is a sentence. Honouring it is a system. A notice that grants rights it cannot service is not compliance, it is a written record of the gap.
Before you sign off the rights section of your notice, ask a different question.
If someone asked today for the full list of everyone we shared their data with, and separately asked to nominate a person to act for them, could we honour either without building something new?
Which overlooked right do you see missing most often in Indian privacy notices, the nomination right, or the sharing map limb of access?
