The rights, in plain words
A Data Principal can ask you for information about their personal data, ask you to fix it, ask you to erase it, complain to you when something goes wrong, and name someone to act for them if they die or cannot act. That is the whole list.
- Access to information: a summary of the personal data you process about them and what you do with it, and the other Data Fiduciaries and processors you have shared it with
- Correction, completion and updating of inaccurate, incomplete or out of date data
- Erasure of data you no longer need, unless you must keep it to meet a legal obligation
- Grievance redressal: a way to raise a complaint with you, which you must answer
- Nomination: naming another person to exercise these rights on their behalf in the event of death or incapacity
What is not a DPDP right
There is no right to data portability in the DPDP Act. If a customer asks to have their data moved to a competitor in a machine readable format, that request may arise under a sector rule or a contract; this Act does not create it. Do not promise it as a DPDP right in your notices or your Privacy Centre.
Data Principals also have duties under the Act, such as not filing false or frivolous complaints. Breaching those duties can attract a penalty of up to 10,000 rupees.
Where requests get stuck
Take a hospital. A patient asks for erasure of her records from the appointment app. The app team deletes the profile, but copies sit in the lab system, the billing software, a WhatsApp chatbot vendor and last month's backup. Some of those, such as clinical records, the hospital may have to keep under other laws. Someone has to decide, system by system, what is erased, what is kept and why, and then show the decision.
The difficult work sits behind the form on the website: identifying the person, finding their data across systems, applying the right exception, acting, confirming and replying.
Before the right reaches the requester
Rights only work if people know how to use them. Your notice must tell Data Principals how to exercise their rights and how to complain to the Board. The Rules also expect you to publish how a request can be made and the details the person needs to give.
Verify identity in a way that fits the risk. A request to update a delivery address needs less checking than a request for a copy of someone's loan history.
How TrustOS supports the work
The Privacy Centre gives Data Principals one place to make requests, raise grievances, nominate someone and track status. Each request then becomes an assigned task in the TrustOS workspace with an owner, a due date and a record of what was done.
Where systems are connected, connectors can search for the person's records, act on them and confirm the action, so your reply rests on evidence from the systems themselves. Which exceptions apply in your sector is a question for your legal team; TrustOS records the decision your legal team reaches and does not replace legal advice.
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.