Under the DPDP Act, individuals have the right to access a summary of their personal data and who it was shared with, to correct, complete, update and erase it, to grievance redressal, and to nominate someone to exercise these rights after their death or incapacity. Businesses must publish how to make requests and answer grievances within a period not exceeding 90 days (Rule 14). Individuals must use the business's grievance process before complaining to the Data Protection Board.
- Rights
- Access, correction & erasure, grievance, nomination
- Response time
- Up to 90 days (Rule 14)
- Data portability
- Not a right under DPDP
| Right | What the individual can ask for | Section |
|---|---|---|
| Access | A summary of their data and processing, and the identities of others it was shared with | 11 |
| Correction and erasure | Correct, complete or update data, and erase data no longer needed (unless law requires retention) | 12 |
| Grievance redressal | A readily available means to complain, answered within the published period | 13 |
| Nomination | Nominate a person to exercise rights on death or incapacity | 14 |
Duties of individuals
Section 15 also places duties on individuals: comply with the law, do not impersonate anyone, do not suppress material information, do not file false or frivolous complaints, and give only verifiably authentic information when correcting data. Breach can attract a penalty of up to ₹10,000.
Setting up a request process
- A web form or email address published with the DPO or contact person
- Identity check before releasing data
- A tracker with due dates and responses
- Templates for each type of reply
Frequently asked questions
How long does a business have to respond to a DPDP request?
Rule 14 requires businesses to publish their response period for grievances, which must not exceed 90 days.
Is there a right to data portability under DPDP?
No. Unlike the GDPR, the DPDP Act has no data portability right.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.