Data protection · Provision
A person whose data you hold can ask for a summary of it, what you do with it, and everyone you shared it with. Section 11 is the DSAR section. (Section 11, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Under Section 11 of the DPDP Act 2023, a Data Principal can ask a Data Fiduciary to which she gave consent for a summary of her personal data being processed and the processing activities undertaken, the identities of every other Data Fiduciary and Data Processor it was shared with and a description of what was shared, and any other information the Rules prescribe. It is the Indian basis for a data subject access request (DSAR). Correction and erasure are rights under section 12; nomination is under section 14.
11. Right to access information about personal data.— (1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,— (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed. (2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.
| Item | Provision | Exception |
|---|---|---|
| Summary of the personal data being processed | s.11(1)(a) | None in section 11 |
| Processing activities undertaken with it | s.11(1)(a) | None in section 11 |
| Every other Data Fiduciary and Data Processor it was shared with, and what was shared | s.11(1)(b) | Sharing with a fiduciary authorised by law, on its written request, for offences or cyber incidents (s.11(2)) |
| Any other information the Rules prescribe | s.11(1)(c) | The same, under s.11(2) |
| Correction, completion, updating, erasure | Section 12, not section 11 | — |
| Nominating someone to exercise the rights | Section 14, not section 11 | — |
Grievance, then the Board. An unanswered request goes first to the Data Fiduciary's grievance route under section 13, and then to the Data Protection Board.
Section 11 of the Digital Personal Data Protection Act, 2023 gives a Data Principal the right to ask a Data Fiduciary to which she gave consent for a summary of the personal data it is processing and the processing activities, and the identities of the other Data Fiduciaries and Data Processors with whom it has been shared. This is the statutory basis for a Data Subject Access Request (DSAR) in India.
A Data Subject Access Request: a request from a Data Principal under section 11 of the DPDP Act, 2023 for a summary of the personal data a Data Fiduciary processes about her, the processing activities, and who it has been shared with. It is made, and answered, in the manner the Rules prescribe.
Yes, but under section 12, not section 11. Section 12(3) requires the Data Fiduciary to erase the personal data on request unless retaining it is necessary for the specified purpose or for compliance with a law in force.
Within the period prescribed by the DPDP Rules, 2025. A request left unanswered can be taken through the grievance route under section 13 and then to the Data Protection Board.
Only in the case section 11(2) describes: sharing with another Data Fiduciary authorised by law to obtain the data, on its written request, to prevent, detect or investigate offences or cyber incidents, or to prosecute or punish offences. Otherwise the identities must be given.
Not expressly. The Act gives rights of access (section 11), correction and erasure (section 12), grievance redressal (section 13) and nomination (section 14). It has no equivalent of GDPR Article 20.
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 11 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.