Data Principal Rights Under DPDPA: Building a Request Workflow That Scales

The DPDPA arms every individual — every Data Principal — with enforceable rights, and arms the Board with penalties when fiduciaries fumble them. Sections 11–14 grant:

• Access (s.11): a summary of the personal data processed, the processing activities, and the identities of all fiduciaries and processors the data was shared with.
• Correction, completion, updating and erasure (s.12): fix inaccurate data; erase data no longer needed for its purpose unless retention is legally required.
• Grievance redressal (s.13): a readily available means of grievance, answered within the period set by the DPDP Rules — exhaust this before escalating to the Board.
• Nomination (s.14): appoint someone to exercise rights in case of death or incapacity — a right unique to India, and one your data model probably doesn't support yet.

The workflow that survives an audit

1. Intake, everywhere. Requests arrive via portal, email, phone and in-app. Funnel them into one queue with a stamped receipt time — the clock starts at receipt, not triage.

2. Verify identity. Erasing or exporting the wrong person's data converts a rights request into a data breach. Match verification strength to request sensitivity.

3. Locate the data. This is where programmes die. You cannot answer an access request if you don't know where the data lives — a live Record of Processing Activities and data map is the prerequisite (see obligations guide).

4. Execute and propagate. Corrections and erasures must reach downstream processors and shared systems too — the Act holds you accountable for data you passed on.

5. Respond in plain language, and log everything. What was done, by whom, when, and the artefacts to prove it.

SLAs and volume reality

One-off manual handling works until a viral moment produces five hundred erasure requests in a week — or a mass-withdrawal event hits your consent base. Design for spikes: automation for the straightforward 80%, humans for the ambiguous 20%.

That split is exactly how Adhikari, Data Adhikaar's rights agent, works — verifying identity, locating data across connected systems, fulfilling routine requests automatically and escalating edge cases inside the statutory SLA, with every step logged to the Evidence Vault. Score your current readiness in 3 minutes.