Data Principal rights under DPDP and the 90-day rule
Reviewed against the law as of 28 September 2026
Data Principal rights under the DPDP Act: access, correction, erasure, grievance and nomination, the 90-day response limit and a workable process.
The DPDP Act gives individuals, called Data Principals, a small set of clear rights. The DPDP Rules require organisations to publish how people can exercise them and to respond within ninety days at most.
The rights
| Right | Section | What you provide |
|---|---|---|
| Access to information | 11 | A summary of the personal data processed and the processing activities; the identities of other Data Fiduciaries and Data Processors it was shared with, and what was shared |
| Correction and erasure | 12 | Correct inaccurate or misleading data, complete incomplete data, update it, and erase data no longer needed unless the law requires keeping it |
| Grievance redressal | 13 | A readily available means to raise grievances, answered within the prescribed period, before a complaint to the Board |
| Nomination | 14 | Let the person nominate someone to exercise their rights on death or incapacity |
The right of access does not apply to sharing with other Data Fiduciaries authorised by law to obtain data for preventing, detecting or investigating offences.
Duties of Data Principals
Section 15 also gives individuals duties: to follow applicable laws, not impersonate others, not suppress material information when providing data for official documents, not register false or frivolous complaints, and to provide only verifiably authentic information when exercising the right to correction. Breaching these can attract a penalty of up to ₹10,000.
The ninety-day limit
The Rules require you to publish on your website or app the means to make a request and the details needed to identify the person, and to respond within a period you set that does not exceed ninety days. Treat ninety days as the outer limit, not the target.
A workable process
- Intake. One channel for all rights requests, in the account and on the website, with the published details you need.
- Verify. Confirm identity proportionately, for example a one-time password to the registered contact, and record the method.
- Plan. Use your data inventory to list every system holding the person's data, and create a task per system.
- Act. Produce the summary, make corrections, or erase, including in processors' systems.
- Verify completion. For erasure, confirm the data is actually gone, not just hidden, and keep the evidence.
- Respond and record. Reply in plain language, and keep the request, decisions and dates for the Board.
Erasure is harder than it looks
Erasure touches primary databases, replicas, analytics copies, logs, backups and processors. Decide in advance how each is handled: some data must be kept for legal reasons, backups may be erased on rotation. Document the reasoning. See retention and erasure.
Grievances and the Board
A person must first use your grievance redressal before complaining to the Data Protection Board. Slow or dismissive handling therefore leads directly to regulatory attention.
TrustNiq plans rights requests from the data inventory, runs the ninety-day clock, records identity verification and checks that erasure actually happened in each system. Start a free trial.
Frequently asked questions
How long do we have to respond to a DPDP rights request?
The DPDP Rules require Data Fiduciaries to respond to requests for access, correction, updating and erasure, and to grievances, within a period they publish, which cannot exceed ninety days.
Does the DPDP Act include a right to data portability?
No. The Act does not include a portability right like GDPR's. It gives a right to a summary of the personal data processed and of who it was shared with.
Must we verify the person's identity?
Yes, you should verify identity before disclosing or changing data, using means proportionate to the data involved, and record how you did it.
Sources
- Digital Personal Data Protection Act, 2023, sections 11 to 15meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.