Compliance
Without a valid nominee, a data principal's rights under the DPDP Act die with them, costing businesses lost compliance and potential disputes over data access, correction or erasure.
Check your DPDP readiness — free More on the blogThe Digital Personal Data Protection Act gives individuals the right to control their personal data. Section 14 adds a crucial twist: a data principal can nominate another person to exercise those rights if they die or become incapable. For a business that stores customer data, this means the right to access, correct, erase or lodge a grievance does not vanish with the principal. The nomination must be recorded in the manner prescribed by the rules, and the data fiduciary must honour it.
When a data principal decides to nominate, they submit the name of the chosen individual following the prescribed process. The nominee does not receive the data itself; instead, they step into the principal's shoes to invoke the same rights. This distinction is important because the nominee's authority is limited to exercising rights, not to owning or using the data. The fiduciary’s role is to accept the nomination and act on any request the nominee makes, just as it would for the original data principal.
Incapacity under the Act is defined narrowly. It refers to an inability to exercise rights because of unsoundness of mind or a physical infirmity. General legal definitions of incapacity do not apply; the Act provides its own criteria. If a data principal meets this definition, the nominated individual automatically gains standing to act on their behalf, ensuring continuity of rights without waiting for a court order or other legal formalities.
Many small enterprises overlook the need to capture nominations because they are accustomed to banking or insurance forms. However, the DPDP Act requires a specific nomination for data rights, separate from other legal instruments. Without a proper nomination, there is no standing party to request access, correction or erasure after the principal’s death or incapacity, potentially leading to compliance gaps and disputes with regulators. The cost of not having a nomination is not a direct monetary fine, but indirect losses. Regulators may view the absence of a nominee as a failure to uphold the survivability of data rights, leading to penalties for non‑compliance. Moreover, customers may lose trust if they perceive that their data rights cannot be exercised after they are no longer able to act themselves. Implementing a simple nomination capture process can mitigate these risks. It can be as straightforward as adding a field in your data collection forms, with clear instructions and a consent checkbox. Ensure that the stored nomination is securely maintained and can be retrieved by the fiduciary when needed. Regular audits should verify that nominations are being recorded correctly and that staff understand the distinction between a nominee’s authority and data ownership. Training helps avoid the mistake of providing the nominee with a full data dump, which the Act does not require. By treating the nomination as a core part of your data governance framework, you protect both the data principal’s rights and your business from compliance headaches. The right to nominate makes data rights survivable, turning a potential legal void into a manageable process.
The nominee can request access, correction, erasure or file a grievance on behalf of the data principal, using the same procedures the principal would follow. The nominee does not receive the data itself, only the authority to act.
If a fiduciary refuses to accept a valid nomination, the data principal’s rights may become unenforceable after death or incapacity, exposing the business to regulatory penalties for non‑compliance with the DPDP Act.
No. The Act requires an explicit nomination by the data principal. A legal heir only gains standing if they have been named in the prescribed nomination process.
No. The DPDP Act’s nomination is specific to exercising data rights. It must be recorded according to the Act’s rules, separate from any other financial or insurance nominations.
Published 30 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.