Data Principal Rights and Nomination Under the DPDP Act

Introduction

From 13 May 2027, businesses processing digital personal data in India must answer people who ask what is held about them, want it corrected or deleted, complain, or name someone to act for them after death. These are the rights of the data principal (the individual the data is about) in Chapter III of the Digital Personal Data Protection Act, 2023 (the DPDP Act), with mechanics in Rule 14 of the DPDP Rules, 2025.

The rights are narrower than many assume. Two depend on the ground of processing, access omits certain disclosures, and erasure has two exceptions. Nomination creates a form of digital succession that sits beside bank, securities and inheritance law, not inside it.

The legal position

Access (s.11). A data principal may obtain from the data fiduciary (the business that decides why and how her data is processed) a summary of the personal data processed and the processing activities; the identities of all other fiduciaries and data processors (vendors acting on a fiduciary's behalf) with whom it was shared, with a description of what was shared; and any other prescribed information.

Correction and erasure (s.12). She may have her data corrected, completed, updated and erased, "in accordance with any requirement or procedure under any law". On an erasure request the fiduciary must erase "unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force" (s.12(3)).

The ground limitation. Both rights run only against a fiduciary to which she "has previously given consent, including consent as referred to in clause (a) of section 7". Section 7(a) covers data a person voluntarily provides for a specified purpose without indicating that she does not consent to its use.

Grievance (s.13). Fiduciaries and consent managers (Board-registered intermediaries through which people manage consent) must provide readily available grievance redressal. Rule 14(3) requires them to publish a response period of no more than 90 days. Under s.13(3) the data principal must exhaust this route before approaching the Data Protection Board (the Board).

Nomination (s.14). She may nominate "any other individual" to exercise her rights "in the event of death or incapacity". Incapacity means inability to exercise them "due to unsoundness of mind or infirmity of body". Rule 14(4) lets her nominate one or more individuals through the means the fiduciary sets under its terms of service.

Duties (s.15). Data principals must follow applicable law, not impersonate anyone, not suppress material information in applications for State-issued documents, not "register a false or frivolous grievance or complaint" (s.15(d)), and "furnish only such information as is verifiably authentic" when seeking correction or erasure (s.15(e)). Breach of these duties carries a penalty of up to ₹10,000, and under s.28(12) the Board may warn a complainant or impose costs if it considers a complaint false or frivolous.

Mechanics. Fiduciaries and consent managers must publish how to make a request and which identifiers, such as a username, mobile number or customer number, they need (Rules 14(1) and 14(5)). Every response must carry the privacy contact (Rule 9).

Analysis

Rights follow the ground

On the literal reading, which we take, access, correction and erasure exist only for consent-based and s.7(a) processing. Data processed solely on another s.7 ground, such as a medical emergency or employment, falls outside ss.11 and 12. Trayambic's article on background checks and employee monitoring applies this to staff processed only under s.7(i). Grievance and nomination carry no such limit, and the fiduciary's own duties, such as accuracy (s.8(3)) and erasure when the purpose ends (s.8(7)), apply whatever the ground. Where s.17(1) applies, for example to enforcing a legal claim or investigating an offence, Chapter III falls away entirely.

Rule 14(2) refers to the fiduciary to which she "has previously given consent" and omits the s.7(a) words. In our view a rule cannot narrow the Act, so s.7(a) data principals keep their rights.

The access summary has a deliberate gap

Section 11(2) disapplies the recipient list (and other prescribed information) for sharing with a fiduciary "authorised by law to obtain such personal data", where the sharing follows "a request made in writing" by it "for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences". All three conditions must be met: a written notice from an investigating agency qualifies; an oral request or a volunteered disclosure does not. The s.11(1)(a) summary is still owed, and it is only a summary: there is no right to a copy.

Erasure has two exits

Retention survives an erasure request where it is necessary for the specified purpose or for compliance with law. The second covers KYC, tax and sector records. The first is easier to misuse: in our view it covers an unfinished transaction the person still wants completed, not a wish to keep data in case it proves useful. Erasure reaches processors through s.8(7)(b).

Grievance first, Board second

The Act sets no deadline for access, correction or erasure. An ignored request becomes a grievance, answerable within the published period; only then may the person go to the Board, which has no members as of October 2026. Sector rules may run faster: 30 days to correct credit information under s.21 of the Credit Information Companies (Regulation) Act, 2005, which s.12(1) brings in, and seven days for intermediaries' grievances under the IT Rules, 2021.

No portability and no right to object

There is no right to data portability and no general right to object. The GDPR has both (Articles 20 and 21); Trayambic's whitepaper comparing the DPDP Act with the GDPR sets out the gap. The nearest equivalents are withdrawal of consent, which s.6(6) requires the fiduciary to act on within a reasonable time, and, in our view, telling a fiduciary relying on s.7(a) that she does not consent to a use, which ends that ground for the future.

Verify identity before answering

Answering an impostor is a personal data breach (s.2(u)), with Rule 7 notices to the Board and the person. A logged-in session, or a one-time code to the registered mobile or email, is usually enough. New identity documents add data and risk; reserve them for nominees, guardians and disputed requests. For a child, the parent or lawful guardian is the data principal (s.2(j)).

Consent managers as a channel

Under s.6(7) a person may give, manage, review or withdraw consent through a registered consent manager. A withdrawal arriving that way triggers the duties to stop processing (s.6(6)) and to erase (s.8(7)). Rule 4 takes effect on 13 November 2026, but no consent manager can be registered until the Board is constituted. Trayambic's insight on consent managers covers the regime.

Nomination and digital succession

Section 14 hands the nominee the person's rights under the Act and nothing more; it says nothing about property. Compare the routes that operate after a death:

In Shakti Yezdani v Jayanand Jayant Salgaonkar (2023 INSC 1076), the Supreme Court held that a securities nominee does not get absolute title, because nomination is not a third mode of succession. The DPDP nominee is further still from ownership. Platform legacy features differ too: one large platform's legacy contact needs an access key and a death certificate, another releases data after an inactivity period the user sets, and neither covers incapacity, so a Rule 14(4) process built on them must add it. Trayambic's capital markets study compares SEBI and DPDP nominees.

Where there is no nominee, the Act is silent. In our view a fiduciary may act for legal representatives on a court grant or order (s.7(e)), and should otherwise keep only what law requires.

Practical implications

A worked example (illustrative). An investing app run by a SEBI-registered stock broker receives two requests.

An access request. A logged-in user asks what the app holds and who has received it, so no further identity check is needed. Within 30 days, well inside the 90-day grievance ceiling, the app sends a summary (profile, KYC, bank details, orders, holdings, risk profile, chats, marketing preferences) and the recipients: exchanges, clearing corporation, depository, KYC registration agency and the app's own vendors. A written police notice from a fraud investigation is left off under s.11(2), and the response names the privacy contact.

Requests after her death. Her husband, the demat nominee, seeks transmission of her securities under SEBI's rules. Her adult son, named in the app as DPDP nominee, asks for a summary of what the app holds, so the family can trace her accounts, and for the marketing messages to stop. The broker matches a death certificate and the son's identity against the nomination record, sends the s.11 summary and withdraws the marketing consents. When he asks for deletion, it closes the profile but keeps account and transaction records for the eight years the Stock Brokers Regulations, 2026 require (s.12(3)). Her brother, who holds no nomination, asks for her login; the broker declines and offers to act on a succession grant or court order.

Rights-request handling table

Key takeaways

Rights requests will arrive from 13 May 2027 whether or not the Board is sitting. Businesses that cope will know the ground for each dataset, verify requesters without collecting more data, and treat nominees as distinct from heirs.

• Access, correction and erasure under ss.11 and 12 apply only to consent-based and s.7(a) processing; grievance and nomination apply to all.
• The access summary need not list sharing with authorised agencies made on a written request for offences or cyber incidents (s.11(2)).
• Erasure may be refused only where retention is necessary for the specified purpose or for compliance with law (s.12(3)).
• Grievances must be answered within a published period of no more than 90 days and exhausted before a complaint to the Board.
• A DPDP nominee exercises data rights on death or incapacity; assets pass under bank, SEBI and succession rules.