How to Respond to a DPDP Act Data Subject Request

Data Principal Rights Under DPDP Act

Section 11 of the DPDP Act gives data principals the right to obtain a summary of the personal data being processed and the processing activities undertaken. Section 12 gives the right to correction, completion, updating, and erasure of personal data. Section 13 gives the right to grievance redress through the Data Fiduciary's grievance mechanism.

These rights are narrower than GDPR's data subject rights (which include portability, objection, and restriction), but they are legally enforceable obligations. Data Fiduciaries must have processes in place to handle each type of request.

Building a Request Intake Process

Create a dedicated channel for data principal requests. Options: a privacy request form on your website or app, a dedicated email address (privacy@yourcompany.com), or an in-product "My Data" section. Document which channel is used and publicise it in your privacy notice.

When a request is received: log the request immediately (date, type, requester contact), assign an owner, and acknowledge receipt to the requester with an expected response timeline.

Use a ticketing system (Jira, Linear, Notion) to track each request through the workflow. This creates an audit trail without requiring a specialised privacy request management tool.

Identity Verification

Before fulfilling any request, verify that the requester is the data principal (or their authorised nominee). The DPDP Act allows data principals to nominate a person to exercise rights on their behalf in case of death or incapacity.

Identity verification approach: match the requester's contact information against the personal data you hold. For consumer products: verify the registered email or phone number. Do not over-verify — requiring excessive documentation effectively denies legitimate rights.

Handling Access Requests

For an access request (Section 11), provide: a summary of the categories of personal data held, the purposes for which it is processed, and the names of third parties with whom it has been shared. You are not required to provide raw data exports — a clear summary satisfies the Act.

Prepare a template response. Map your data categories in advance (from your data inventory or ROPA) so you can generate accurate responses quickly.

Timeframe: respond within the period specified in Rules. Until Rules are published, use GDPR's 30-day standard as a working target.

Handling Erasure Requests

For an erasure request (Section 12), evaluate: is there a legal obligation to retain the data (tax records, regulatory requirements)? Is there a contractual obligation (active service agreement)? Is the data necessary for an ongoing matter (legal proceedings)?

If erasure is permissible: delete the data from production systems, request deletion from data processors, and confirm deletion to the requester. Document each step.

If erasure is not permissible: explain why in clear language, cite the specific legal or contractual basis for retention, and provide an expected erasure date if retention is time-limited.

Grievance Redress

Section 13 requires Data Fiduciaries to provide an effective mechanism for data principals to raise grievances. Designate a Data Protection Officer or Grievance Officer — for companies below the Significant Data Fiduciary threshold, this can be the person who handles privacy requests generally.

Publish the contact details of your Grievance Officer prominently in your privacy notice. Acknowledge grievances within a reasonable timeframe (30 days is a practical standard). Data principals who are unsatisfied with your response can escalate to the Data Protection Board of India.

Logging and Evidence

Maintain a data subject request register. For each request: date received, type of request, requester identifier (anonymised), response date, resolution (fulfilled/denied/partial), and reason if denied.

This register is your DPDP compliance evidence. It demonstrates that you have a functional rights-handling process and that you respond to requests.

Review the register quarterly: check for unusual patterns, ensure no requests are past due, and use the data to improve your response templates.