Data privacy (DPDP Act, 2023) · Template

DSAR data access report template

Section 11 gives a data principal the right to know what personal data of theirs you are processing, and with whom it has been shared. The first request usually arrives without warning, and the quality of the response is a direct signal of whether the organisation actually knows where its data lives.

Generate this document See all 21 templates

When you need this

  • When any individual asks what personal data you hold about them
  • Where an employee or ex-employee makes an access request
  • As part of a wider complaint, where the access request is the opening move
  • When a customer asks who their data has been shared with
  • As a readiness exercise before a request arrives, to find out whether you can answer at all

What this document must contain

  • Confirmation of what is being processed — A summary of the personal data held about the requester. This is the substance of the s. 11 right.
  • The processing activities involved — What you do with it and for what purpose, in terms the requester can follow.
  • Identities of other fiduciaries it has been shared with — Section 11 extends to the identities of those with whom the data has been shared and what categories were shared. Naming them is part of the answer.
  • Verification of the requester — Disclosing personal data to someone impersonating the data principal is itself a breach. Record how identity was verified, proportionately.
  • The date of the request and of the response — Establishes the response window was met, and creates the record if it is ever questioned.
  • How to seek correction or erasure — The natural next step, and telling them makes the response useful rather than merely compliant.
  • The grievance route — Where the requester is dissatisfied, they are entitled to escalate. Say how.

The law that governs it

  • DPDP Act, 2023 — s. 11 — A data principal has the right to obtain a summary of personal data being processed and the processing activities undertaken, the identities of other data fiduciaries with whom the data has been shared along with the categories shared, and any other prescribed information.
  • DPDP Act, 2023 — ss. 12–13 — The rights to correction, completion, updating and erasure, and to grievance redressal, sit alongside the access right and are commonly exercised together.
  • DPDP Act, 2023 — s. 8(10) — The fiduciary must publish contact information for a person able to answer questions about processing — which is usually where these requests should be directed.

Common mistakes

  • Sending a raw database export, which is neither a summary nor readable
  • Omitting the sharing disclosure, which is an express part of the s. 11 right
  • Skipping identity verification, and disclosing personal data to the wrong person
  • Missing the response window because nobody owned the request
  • Answering only for the primary system while data sits in three others

Frequently asked questions

What is a DSAR under the DPDP Act?

A data subject access request — under the DPDP Act, 2023, the s. 11 right of a data principal to obtain a summary of the personal data being processed about them and the processing activities undertaken, together with the identities of other data fiduciaries the data has been shared with and the categories of data shared.

How long do I have to respond?

Response timelines are prescribed in the rules made under the Act rather than fixed on the face of s. 11, so confirm the current requirement. Operationally, the request should be acknowledged immediately and answered within the prescribed period, with the dates recorded.

Can I refuse an access request?

The Act contains exemptions and limitations, and disclosure must not compromise the rights of other individuals. A refusal or a partial response should state the basis rather than simply omitting material, because an unexplained gap is what turns a request into a grievance.

How should I verify who is making the request?

Proportionately to the sensitivity of the data. Enough to be confident the requester is the data principal, without demanding more identity documents than the request warrants — over-collection in the name of verification is itself a processing decision you have to justify.

Related documents