A Data Principal must comply with all applicable laws while exercising her rights under the Act.
She must not impersonate another person while providing her personal data for a specified purpose, and must not suppress material information while providing personal data for a document, unique identifier, proof of identity or proof of address issued by the State.
She must not register a false or frivolous grievance or complaint with a Data Fiduciary or with the Board.
While exercising the right to correction or erasure, she must furnish only information that is verifiably authentic.
These duties are the only place in the Act where the obligation runs towards the business rather than away from it.
Schedule penalty
up to ₹10,000. The smallest head in the Schedule by a wide margin, and the only one directed at the individual rather than the business.
Where people go wrong
Reading the Act as one-directional. Section 15 places duties on the Data Principal, including not filing a frivolous complaint.
Expecting the penalty to deter volume. At up to ₹10,000 it is a check on abuse, not a defence a business can plan around.
Using section 15 as a reason to refuse a request. The duties are enforced by the Board, not by the Data Fiduciary declining to respond.
Assuming a disputed request is a false one. A grievance that fails is not automatically frivolous.
Common questions
Does the DPDP Act place any duties on individuals?
Yes. Section 15 requires a Data Principal to comply with applicable laws when exercising her rights, not to impersonate another person, not to suppress material information for State-issued documents, not to file a false or frivolous complaint, and to furnish verifiably authentic information when seeking correction or erasure.
What is the penalty for a frivolous complaint?
The Schedule provides up to ₹10,000 for breach of the duties of a Data Principal. It is the smallest head in the Schedule.
Can a business ignore a request it thinks is frivolous?
No. Breach of the duties in section 15 is for the Board to act on. The Data Fiduciary still has to deal with the request and with the grievance route under section 13.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.