Rights and duties
What rights do people have under DPDP?
- Short answer
- Four. The right to access a summary of their data and the processing, the right to correction, completion, updating and erasure, the right to grievance redressal, and the right to nominate someone to exercise their rights if they die or become incapable.
The nomination right is the one most often missed, because it has no direct equivalent in the regimes that most templates are copied from. A policy that lists only access, correction and erasure is incomplete.
The access right is broader than a copy of the data. It extends to a summary of the processing activities and to the identities of other Data Fiduciaries and Processors with whom the data has been shared, together with a description of what was shared.
Rights requests need a route and an identity check. You are entitled to verify who is asking before you act, and you should, since acting on an unverified request is itself a disclosure.
Where this comes from
- Sections 11 to 14, DPDP Act 2023
- Rule 14, DPDP Rules 2025
The mistake people make
Publishing a rights section lifted from a GDPR notice, which omits nomination and misstates the scope of access.