Data protection · Provision
A person whose data you hold can ask what you hold, demand corrections, request erasure, and nominate someone to exercise rights after their death. Section 11 is the DSAR section.
Quick Statutory Answer
Section 11 of the DPDP Act 2023 empowers Data Principals to exercise statutory rights including obtaining a summary of personal data processed, identities of all fiduciaries with whom data is shared, requesting correction of inaccurate data, and demanding erasure when the purpose ends. It also provides the right to nominate another individual to exercise rights upon death or incapacity.
| Right | Statutory Scope (Section 11) | Fiduciary Obligation | Statutory Response Limit |
|---|---|---|---|
| Right to Access Summary | Summary of personal data held & processing activities | Provide readable summary without disclosing trade secrets | Within period prescribed by Rules |
| Identities of Shared Parties | Names of third-party fiduciaries given data access | Disclose all fiduciaries with whom data was shared | Within period prescribed by Rules |
| Right to Correction | Rectify inaccurate, misleading or incomplete data | Update records across databases and notify processors | Within period prescribed by Rules |
| Right to Erasure | Delete personal data no longer needed for purpose | Erase data across all systems unless required by law | Within period prescribed by Rules |
| Right to Nominate | Appoint representative for death or incapacity | Record nominee and honour authorised requests | On verification of nominee status |
Board complaint. A Data Principal whose request is not responded to may complain to the Data Protection Board.
Section 11 of the Digital Personal Data Protection Act, 2023 gives a Data Principal the right to ask a Data Fiduciary for a summary of the personal data it holds, the processing activities, and the other Data Fiduciaries with whom the data has been shared. This is the statutory basis for a Data Subject Access Request (DSAR) in India.
A Data Subject Access Request — a request from a Data Principal under section 11 of the DPDP Act, 2023 for access to the personal data a Data Fiduciary holds about them, the purposes for which it processes it, and the entities it has shared it with. The Data Fiduciary must respond within the period prescribed by the Rules.
Yes. Section 11(3) gives a Data Principal the right to request erasure of personal data where it is no longer necessary for the purpose of collection. The Data Fiduciary must erase it unless a law requires retention.
Within the period prescribed by the DPDP Rules, 2025. The Rules set the response timeline. Businesses should treat it as a short statutory deadline — the Board enforces it on complaint.
Section 11(2) gives a Data Principal the right to request correction of inaccurate or misleading personal data and completion of incomplete data. The Data Fiduciary must make the correction within the prescribed period.
Not expressly. Section 11 gives rights of access, correction, erasure and nomination. The Act does not replicate GDPR Article 20, though the Rules may prescribe a delivery format that enables portability in practice.
Yes. Section 11(4) allows a Data Principal to nominate another person to exercise their rights after their death or incapacity. The Data Fiduciary must honour a valid nomination.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.