Compliance
Without a recorded nomination the data rights die with the principal, leaving the firm exposed to compliance risk and potential complaints, so a clear process is essential to keep the rights survivable and avoid regulatory gaps.
Check your DPDP readiness — free More on the blogThe first operational task is to capture the Data Principal's nomination using the form or electronic interface prescribed by the DPDP Rules. The format must include the nominee's full name, contact details and a clear statement of consent. This record becomes the only evidence that the nominee can later rely on, so it should be stored in a tamper‑proof system that the Data Fiduciary can retrieve quickly when required.
During onboarding, the compliance officer should ensure that the nomination step is part of the standard data‑collection workflow. A checklist item can prompt the team to ask the Data Principal if they wish to nominate someone, and if so, to direct them to the prescribed form. The onboarding software must flag incomplete nominations so that no customer record is finalised without this optional but critical piece of information.
All nominations received must be entered into a central registry that is encrypted and access‑controlled. The registry should record the date of nomination, the identity of the Data Principal, and any subsequent updates or revocations. The data‑protection officer is responsible for periodic audits of the registry to confirm that entries match the original submitted forms and that no unauthorised changes have been made.
If a Data Principal informs the firm of a change in nominee, or if the nominee themselves requests an update, the compliance team must process the amendment within the timeframe prescribed by the Rules. The updated entry replaces the earlier one, and the old record is retained for audit purposes. This ensures that, should death or incapacity occur, the latest nominee is the one with standing to act.
When a Data Principal dies or is declared incapable, the firm must verify the event through a legally acceptable document such as a death certificate or medical certificate. Once verified, the data‑protection officer hands over the nomination record to the nominee, who can then exercise rights like access, correction or erasure on the same terms as the original Data Principal. The firm must keep a log of the verification documents and the date of activation.
A written SOP (Standard Operating Procedure) describing each step—from capture to activation—must be drafted and approved by senior management. This SOP should reference the relevant DPDP Rules and be stored alongside the nominee registry. During a regulator audit, the firm will need to produce the SOP, the nominee registry, and any activation logs for the cases that have been triggered.
The business must keep the original nomination form or electronic record that follows the DPDP Rules, along with the nominee's details and the date of submission. This document, stored in the secure registry, serves as the proof that the nominee has standing to exercise the data principal's rights.
A legally recognised death certificate or a medical certificate confirming incapacity is required. The data‑protection officer matches this with the stored nomination record, logs the verification, and then allows the nominee to exercise access, correction, erasure or grievance redressal on the same terms as the original data principal.
Responsibility lies with the data‑protection officer, who ensures the registry is encrypted, up‑to‑date and audited. The compliance team supports the officer by handling updates, revocations and verification of death or incapacity documents.
Without a recorded nomination, no one has legal standing to exercise the data principal's rights, leaving the firm exposed to complaints and potential regulatory action for failing to preserve the survivable rights mandated by Section 14 of the DPDP Act.
Published 15 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.