Data privacy (DPDP Act, 2023) · Template
Section 11 gives a data principal the right to know what personal data of theirs you are processing, and with whom it has been shared. The first request usually arrives without warning, and the quality of the response is a direct signal of whether the organisation actually knows where its data lives.
Quick Statutory Answer
What is a DSAR under the DPDP Act? A data subject access request — under the DPDP Act, 2023, the s. 11 right of a data principal to obtain a summary of the personal data being processed about them and the processing activities undertaken, together with the identities of other data fiduciaries the data has been shared with and the categories of data shared.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
REQUEST ACKNOWLEDGEMENT
Date: [Date of This Report]
To, [Customer's Full Name]
Subject: Response to Your Data Access Request
Dear [Customer's Full Name],
Further to your request to access the personal data we hold about you (identified by: [Customer Identifier Used]), and in accordance with your rights as a Data Principal under Section 11 of the Digital Personal Data Protection Act, 2023, [Your Business Name] is pleased to provide the following summary.
SUMMARY OF PERSONAL DATA HELD
1. Categories of Data. The personal data we currently hold about you includes: [Categories of Data You Hold on This Customer].
2. Source of Collection. This data was collected via: [Where This Data Was Collected From].
3. Purpose of Processing. We process your personal data for the following purposes: [Why You Process This Data].
4. Third-Party Sharing. Your personal data has been shared with the following third parties for the purposes stated above: [Third Parties This Data Was Shared With].
5. Retention Period. We retain your personal data for the following period: [How Long You Retain This Data], after which it is deleted or anonymised unless a longer period is required by law.
6. Your Rights. You have the right to request correction of inaccurate data, erasure of your data (subject to legal exceptions), and to nominate a representative for your data rights, in each case by writing to us.
CLOSING
If any part of this summary appears inaccurate or incomplete, or if you have further questions, please contact us so that we can assist you further.
Yours sincerely, [Your Business Name]
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| Confirmation of what is being processed | A summary of the personal data held about the requester. This is the substance of the s. 11 right. | DPDP Act, 2023 — s. 11 |
| The processing activities involved | What you do with it and for what purpose, in terms the requester can follow. | DPDP Act, 2023 — ss. 12–13 |
| Identities of other fiduciaries it has been shared with | Section 11 extends to the identities of those with whom the data has been shared and what categories were shared. Naming them is part of the answer. | DPDP Act, 2023 — s. 8(10) |
| Verification of the requester | Disclosing personal data to someone impersonating the data principal is itself a breach. Record how identity was verified, proportionately. | DPDP Act, 2023 — s. 11 |
| The date of the request and of the response | Establishes the response window was met, and creates the record if it is ever questioned. | DPDP Act, 2023 — ss. 12–13 |
| How to seek correction or erasure | The natural next step, and telling them makes the response useful rather than merely compliant. | DPDP Act, 2023 — s. 8(10) |
| The grievance route | Where the requester is dissatisfied, they are entitled to escalate. Say how. | DPDP Act, 2023 — s. 11 |
A data subject access request — under the DPDP Act, 2023, the s. 11 right of a data principal to obtain a summary of the personal data being processed about them and the processing activities undertaken, together with the identities of other data fiduciaries the data has been shared with and the categories of data shared.
Response timelines are prescribed in the rules made under the Act rather than fixed on the face of s. 11, so confirm the current requirement. Operationally, the request should be acknowledged immediately and answered within the prescribed period, with the dates recorded.
The Act contains exemptions and limitations, and disclosure must not compromise the rights of other individuals. A refusal or a partial response should state the basis rather than simply omitting material, because an unexplained gap is what turns a request into a grievance.
Proportionately to the sensitivity of the data. Enough to be confident the requester is the data principal, without demanding more identity documents than the request warrants — over-collection in the name of verification is itself a processing decision you have to justify.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.