Compliance
Section 15 of the Digital Personal Data Protection Act makes the data subject responsible for lawful conduct when exercising rights, and a false or frivolous grievance can attract a penalty of up to ten thousand rupees, the only individual‑focused sanction in the schedule.
Check your DPDP readiness — free More on the blogThe Digital Personal Data Protection Act is not a one‑way street. While it gives individuals the right to access, correct or erase their data, Section 15 adds a set of duties that the data principal must follow. These duties are the only provisions that run towards the business rather than away from it, meaning a breach can be enforced against the individual as well as the data fiduciary.
Each duty is designed to prevent abuse of the rights granted by the Act. For example, when a person applies for a passport or a driving licence, they must not hide relevant facts that could affect the issuance of the document. Similarly, the correction or erasure process relies on authentic information to avoid unnecessary changes to records.
If a data principal registers a grievance that is false or frivolous, the Schedule of penalties allows the Board to impose a fine of up to ten thousand rupees. This is the smallest monetary sanction in the Act, but it is the only one directed at an individual rather than a business, serving as a modest deterrent against misuse of the grievance mechanism.
Many businesses mistakenly read the Act as solely imposing obligations on data fiduciaries and assume they can dismiss a request they deem frivolous. In reality, the duty to assess the grievance remains with the fiduciary, and the Board decides whether the individual has breached Section 15. A rejected request does not automatically become a frivolous complaint. Another frequent error is expecting the ten‑thousand‑rupee cap to protect a company from a flood of baseless complaints. The amount is modest and intended as a check on abuse, not a financial shield. Companies must still follow the prescribed grievance process and cannot simply ignore a request on the basis of perceived frivolity. Finally, some assume that any disputed request is automatically false. The Act distinguishes between a request that fails on merit and one that is deliberately false. Only the latter attracts the penalty, and the determination is made by the Board after due process.
By keeping thorough documentation and following the statutory grievance pathway, a business can demonstrate compliance and reduce the risk of a Board finding that a data principal has breached their duties. This also helps in defending against any claim that the company ignored a legitimate request.
Section 15 requires the data principal to obey all relevant laws while exercising rights, not to impersonate anyone, not to hide material facts for State‑issued documents, not to lodge false or frivolous complaints, and to provide only authentic information when seeking correction or erasure.
The Schedule of penalties under the DPDP Act allows a fine of up to ten thousand rupees for a breach of the duties listed in Section 15, making it the smallest but only individual‑focused penalty in the Act.
No. The duty to address a request remains with the data fiduciary, and any allegation of frivolity must be examined by the Board. The fiduciary cannot simply decline to respond on that ground.
The business should follow the grievance process in Section 13, keep detailed records, and, if evidence shows the complaint is false, it may inform the Board. The Board alone can decide whether to impose the Section 15 penalty.
Published 1 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.