A client called me recently, a little worried. A customer had emailed his company asking, “What data of mine do you actually have, and I want it deleted.” He didn’t know how to respond. He wasn’t even sure the customer had a legal right to ask.
They do. And that request is only going to become more common. Every business handling customer data in India needs to understand exactly what rights their customers now hold under the DPDP Act, because ignoring these requests isn’t just bad customer service anymore. It’s a compliance failure with real financial consequences.
So let’s go through what a Data Principal, the legal term for the individual whose data you’re processing, is actually entitled to.
Who Counts as a Data Principal
Before the rights themselves, it helps to understand who this term covers. A Data Principal is simply the person whose personal data is being collected and processed. That’s your customer, your website visitor, your app user, essentially anyone whose information your business holds.
For children, a parent or lawful guardian exercises these rights on the child’s behalf. Similarly, for a person with a disability who cannot act independently, their lawful guardian steps in. The law makes sure vulnerability doesn’t reduce someone’s legal protections.
The Right to Access
Under Section 11 of the Act, a Data Principal can ask your business for a summary of exactly what personal data you’re processing about them. This isn’t a vague overview either. They’re entitled to know your processing activities, and they can also request details of every other data fiduciary and processor who has had access to their information.
In practice, this means a customer can genuinely ask, “What do you know about me, and who have you shared it with?” Your business needs a real process ready to answer that, not a scramble through scattered spreadsheets when the request lands.
The Right to Correction and Erasure
Section 12 covers two related but distinct rights. First, correction. If a customer’s data is inaccurate or outdated, they can ask you to fix it. Second, erasure. They can request that you delete their data entirely.
Here’s the part businesses often miss. Erasure isn’t only triggered by a request. Under Section 8(7) of the Act and Rule 8 of the DPDP Rules 2025, you’re actually required to erase personal data on your own once its original purpose no longer applies, whether because consent was withdrawn, the purpose was fulfilled, or the individual simply stopped engaging with your service within a defined retention period.
Specific sectors even have default retention timelines built in. E-commerce platforms with over 2 crore users, for instance, must erase data three years after a user’s last transaction or login. Online gaming and social media platforms with large user bases follow similar three-year windows. If your business falls into one of these categories, this isn’t optional housekeeping. It’s a defined legal clock.
The Right to Grievance Redressal
Section 13 gives customers the right to raise concerns directly with your business if something feels wrong, whether that’s how their data was collected, how it’s being used, or how a previous request was handled.
This means you need an actual, functioning grievance process. Not just a generic “contact us” email that goes unanswered for weeks. Rule 14 sets specific response timelines that data fiduciaries must follow, so a slow or informal process genuinely puts you at compliance risk.
The Right to Nominate
Section 14 introduces something most businesses haven’t dealt with before. A Data Principal can nominate another person to exercise their rights on their behalf, particularly relevant in the event of death or incapacity.
Practically, this means your systems need a way to recognize and honor a nominee’s requests, not just the original account holder’s. It’s a smaller-scale right compared to access or erasure, but it still needs a real process behind it.
The Right to Withdraw Consent
Consent under the DPDP Act isn’t a one-time checkbox that locks a customer in forever. They can withdraw it at any point, just as easily as they gave it in the first place. Importantly, withdrawal doesn’t undo processing that already happened lawfully before that point, but it does mean you must stop future processing based on that consent immediately.
If your consent withdrawal process currently requires a customer to call a helpline or send multiple emails, that’s a problem. The right needs to be as accessible as the original consent was.
Why This Isn’t Just a Legal Checkbox
Here’s the bigger picture. These rights exist to shift real control back to individuals, not just to create paperwork for businesses. Consequently, how your business responds to these requests directly shapes customer trust, especially as more people become aware these rights even exist.
At the same time, non-compliance carries genuine financial risk. Penalties under the DPDP Act can reach up to ₹250 crore for serious violations, and mishandled data principal requests are squarely within scope for regulatory scrutiny.
What Your Business Should Actually Set Up
If you’re not sure whether your current systems can handle these requests properly, here’s where I’d start.
Build a simple, working process for access requests. You need to know, quickly, exactly what data you hold on any given individual and who else has accessed it.
Set up an actual erasure workflow, not just a manual one. Especially if you fall under a sector with defined retention periods, this needs to run reliably, not depend on someone remembering to check a spreadsheet.
Create a real grievance redressal channel. A dedicated process, with clear response timelines, protects you far more than a generic contact form ever will.
Make consent withdrawal genuinely easy. If withdrawing consent is harder than giving it, that mismatch itself becomes a compliance problem.
Getting This Right Before It Becomes a Problem
Most businesses only discover gaps in their data principal rights process after a customer complaint lands, or worse, after a regulator asks. That’s not the ideal time to figure it out.
If you’re unsure whether your business can properly respond to access, correction, erasure, or grievance requests right now, it’s worth finding out before you’re tested on it. I help businesses across Delhi NCR build these processes properly through my DPDP Act Compliance Consulting services. For ongoing support rather than a one-time fix, take a look at DPO services as well. Book a free consultation — Advocate Nitin Kumar Vashista, DPDP Act & GDPR Compliance Consultant, Gurgaon.