IndiaDigital Personal Data Protection Act, 2023, data subject rights
Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must give a data principal a way to exercise their rights to access, correct, complete, update, or erase their personal data, including a stored voiceprint or faceprint, and to nominate another person to exercise these rights, directly against it, with escalation to the Data Protection Board available only after the app's own grievance process is exhausted.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- Do the right of access in section 11(1) and the rights of correction and erasure in section 12(1) reach personal data processed under a legitimate use in section 7 other than clause (a), given that section 11(1) is limited to a Data Fiduciary 'to whom she has previously given consent, including consent as referred to in clause (a) of section 7'?
- Does a Data Principal 'exhaust the opportunity of redressing her grievance' under section 13(3) only when the grievance period published by the Data Fiduciary, which Rule 14(3) of the Digital Personal Data Protection Rules, 2025 lets run up to ninety days, has passed, or also when the Data Fiduciary has answered without resolving it?
What it makes you log
Logging duty
Sections 11 to 14 give the Data Principal the rights to a summary of the personal data processed and the identities of those it was shared with (section 11), to correction, completion, updating and erasure (section 12), to grievance redressal (section 13) and to nominate another person (section 14). A right to read information about one's own data is access to the data and not to a log, and none of the sections requires the Data Fiduciary to keep a log or a record.
- Kind
- None
- As of
What this law does
A data principal may demand a summary of their processed personal data and the identities of the Fiduciaries and Processors it was shared with (s.11), correction, completion, updating and erasure (s.12), grievance redressal against the Fiduciary in the first instance with a complaint to the Board only after that process is exhausted (s.13), and a right to nominate another individual to exercise these rights on death or incapacity (s.14).
No express portability or objection right appears in the Act text as read. Notification G.S.R. 843(E) () appoints eighteen months from its own publication date, , as Chapter III's commencement date.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .