Compliance
Section 11 of the Digital Personal Data Protection Act gives individuals the right to access, correct, erase, and nominate a representative for their data, and failure to comply can lead to a complaint with the Data Protection Board, costing time and reputation.
Check your DPDP readiness — free More on the blogSection 11 creates four core rights for any person whose personal data a business holds. First, the right to request a summary of the data, the processing activities, and the other data fiduciaries with whom the data has been shared. Second, the right to ask for correction of any inaccurate or incomplete information. Third, the right to demand erasure of data that is no longer needed for the purpose it was collected. Fourth, the right to nominate another individual to exercise these rights after death or incapacity.
When a data principal submits a request, the business must provide a concise summary rather than raw internal records. The summary must cover the categories of personal data held, the purposes of processing, and the identities of any other fiduciaries that have received the data. The response must be given within the period set out by the Rules, which are treated as a short statutory deadline. Missing this deadline opens the business to a complaint before the Data Protection Board.
If a data principal points out that the information a business holds is inaccurate, misleading, or incomplete, the business is obliged to amend it. The correction must be made within the same prescribed timeframe as the access response. This duty applies regardless of the internal systems used; the business cannot simply ignore the request or claim the data is needed for future analysis.
A request for erasure must be honoured unless a specific law requires the data to be retained. Businesses often err by refusing erasure on the basis that the data might be useful later. The Act makes clear that speculative future use does not justify non‑compliance. Only a legal retention requirement can override the erasure right.
Section 11 allows a data principal to nominate another person to act on their behalf after death or incapacity. The business must recognise a valid nomination and allow the nominated person to exercise the same access, correction, and erasure rights. Ignoring a nomination can lead to a board complaint and damage the business's reputation.
If a business fails to respond within the required timeframe, the data principal can lodge a complaint with the Data Protection Board. While the Act does not prescribe a monetary penalty in this section, the board process consumes resources, invites regulatory scrutiny, and can harm the business’s brand. The indirect cost of lost trust often exceeds the effort needed to comply promptly.
Set up a simple DSAR inbox and assign a responsible staff member. Draft a template summary that lists data categories, processing purposes, and third‑party fiduciaries. Keep a log of requests, response dates, and actions taken. Review any legal retention schedules to ensure they are up to date, so you can confidently refuse erasure only when required by law.
Section 11 gives data principals clear rights to see, correct, delete, and nominate a representative for their data. Businesses must respond with a summary, correct errors, erase data when no legal hold exists, and respect nominations. Missing the response deadline triggers a board complaint, which can be costly in time and reputation. A straightforward process and clear records keep compliance simple and protect the business.
The company must reply within the period prescribed by the DPDP Rules. The Rules set a short statutory deadline, and failure to meet it allows the data principal to complain to the Data Protection Board.
No. The right to erasure applies unless a specific law requires the data to be retained. Speculative future usefulness does not justify refusal, and ignoring the request can lead to a board complaint.
The summary must cover the personal data held, the processing activities undertaken, and the identities of other data fiduciaries with whom the data has been shared, presented in a concise format rather than raw records.
Yes. Section 11 allows a data principal to nominate another person to exercise access, correction, and erasure rights after death or incapacity, and the fiduciary must honour a valid nomination.
Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this