Compliance
Section 11 of the DPDP Act forces businesses to answer access, correction, erasure and nomination requests within a statutory timeline, otherwise a Data Protection Board complaint can be lodged, exposing the firm to enforcement action and reputational loss.
Check your DPDP readiness — free More on the blogThe first step is to assign responsibility. Typically the compliance officer or a senior manager in the legal function becomes the DSAR lead. This person must maintain a register of all incoming requests, allocate each request to a data‑owner in the relevant department, and track deadlines. The register should capture the request date, the requestor’s identity, the type of right invoked and the target response date as prescribed by the Rules.
When a request arrives, the appointed data‑owner pulls a summary of the personal data held, not the raw database extracts. The summary must list the categories of data, the purposes of processing, and the names of any other Data Fiduciaries with whom the data has been shared. This information is documented in a standard template that the compliance officer reviews before it is sent to the requester.
Before any action, verify the identity of the Data Principal to prevent unauthorised disclosure. Use a two‑factor check such as a government‑issued ID and a confirmation email. If the request is for correction or erasure, confirm that the data is indeed inaccurate, incomplete or no longer needed for the stated purpose. Record the verification steps in the DSAR register for audit purposes.
For correction, the data‑owner updates the record in the source system and notes the change in the register, including the date and the person who made the amendment. For erasure, the system must delete the data permanently unless a legal retention requirement applies. If retention is required, document the statutory basis and inform the requester why the data cannot be erased.
If the request includes a nomination of another person to act after death or incapacity, obtain a written nomination document that meets the Act’s criteria. Store the document securely, link it to the original DSAR entry, and ensure the nominated person is notified of their authority. The same access, correction and erasure processes apply to the nominee.
Within the prescribed period, send a response letter that summarises the actions taken: the data summary provided, any corrections made, data erased or retained, and details of any nomination accepted. Use clear language and reference the relevant clause of Section 11. Keep a copy of the communication in the DSAR register for future inspection.
All DSAR activities must be retained for at least the period required by the Rules. The register, templates, verification logs and any supporting documents form the evidence package if the Data Protection Board issues a complaint. Store these records in a tamper‑evident repository and ensure they are searchable for audit.
Conduct a brief training session for all employees who handle personal data, explaining the DSAR workflow and the importance of responding on time. Periodically audit the DSAR register to spot delays or gaps, and update the standard templates if the Rules change. Continuous improvement reduces the risk of non‑compliance and the associated Board complaint cost.
The response must be given within the period set out in the DPDP Rules. The Rules prescribe a short statutory deadline, and failure to meet it allows the Data Principal to lodge a complaint with the Data Protection Board.
The Act requires a summary of the personal data, the processing activities and the other Data Fiduciaries with whom the data has been shared. Providing raw internal records would breach Section 11.
No. Section 11(3) obliges the Data Fiduciary to erase data that is no longer necessary for the purpose of collection, unless a specific law mandates retention. Refusing erasure on the basis of future usefulness is not permissible.
The firm must retain the DSAR register, verification logs, the summary provided, correction or erasure logs, nomination documents and all correspondence. These records demonstrate compliance and are examined by the Board during a complaint.
Published 12 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.