Compliance
Businesses must follow a clear process when a data principal exercises rights, ensuring compliance with Section 15 of the DPDP Act and avoiding penalties of up to ₹10,000 for false complaints or misuse of information
Check your DPDP readiness — free More on the blogWhen a request arrives, the first point of contact – typically the compliance officer or data protection officer – logs the request in a central register. The log records the request type, date, the data principal’s identity, and the channel used. This creates an audit trail that satisfies the duty to comply with applicable laws and provides evidence if the Board later investigates the request.
Before any action, the business must verify that the requestor is the genuine data principal. This involves checking government‑issued proof of identity or address, as required by law, without impersonating another person. The verification team documents the documents examined and notes any discrepancies, ensuring that only authentic information is used for correction or erasure.
The compliance team reviews the request to determine whether it is false or frivolous. This does not mean rejecting the request outright; instead, the team checks if the grievance lacks factual basis or is made in bad faith. If doubts arise, the team records the rationale and escalates to senior management for a decision, keeping the record for possible Board review.
Once the request is deemed legitimate, the responsible department – for example, IT for data erasure or HR for correction – carries out the action within the statutory time‑frame. The action taken, the date of completion, and the person responsible are all entered into the register. This documentation demonstrates compliance with the duty to furnish only verifiably authentic information.
If the data principal files a grievance, the business must follow the grievance procedure under Section 13. The compliance officer records the grievance, acknowledges receipt, and forwards it to the Board if required. The business must not dismiss the grievance as frivolous without proper assessment, as the Board, not the business, decides on the penalty.
All records – request logs, verification notes, decision rationales, and action confirmations – must be stored securely for at least the period prescribed by law. If the Board initiates an enquiry, the business can produce these records to demonstrate that it complied with Section 15 duties, thereby avoiding the ₹10,000 penalty.
Regular training sessions for staff handling data principal requests reinforce the duties under Section 15. Training logs, attendance sheets, and updated SOPs should be kept as part of the compliance evidence. This proactive step reduces the risk of inadvertent breaches and shows the Board that the business takes its obligations seriously.
The business should maintain a request register, identity verification notes, any assessment of frivolity, the decision rationale, and a record of the corrective or erasure action taken. These documents form the audit trail required under Section 15 and are needed if the Board investigates.
No. The company must assess the request, document its reasoning, and follow the grievance process. Only the Board can determine whether a complaint is frivolous and impose the up to ₹10,000 penalty.
Typically the data protection officer or compliance officer receives the request, while verification may involve the legal or HR team. Execution of correction or erasure is done by the relevant operational department, all coordinated by the compliance function.
If a data principal files a false or frivolous complaint, the Schedule of penalties allows a fine of up to ₹10,000. While modest, it serves as a check against abuse and can affect the business’s reputation if the Board publicises the breach.
Published 16 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.