Chapter IV of the DPDPA grants individuals new rights over their personal data. Businesses must build operational processes to receive, verify, and respond to these requests — or face penalties.
The rights framework in DPDPA is enforceable. Individuals can file complaints with the Data Protection Board if their rights requests are ignored or mishandled. For businesses, this means that a 'delete my data' email from a former customer is now a legal request with a response obligation, not an optional feedback message.
Businesses need a designated contact for data-related requests. They need a workflow to receive, verify, and resolve access and deletion requests. Response timelines must be built into operational procedures. Refusals must be documented with reasons.
The DPDPA grants Data Principals four core rights: (1) Right to access information about personal data being processed; (2) Right to correction and erasure of inaccurate or unnecessary data; (3) Right to grievance redressal through a designated contact at the organisation; and (4) Right to nominate someone to exercise these rights in case of death or incapacity. Businesses must designate a point of contact, establish a process to verify the identity of the requester, respond within the prescribed period, and document the outcome. Deletion requests may have exceptions — for example, where data is required for legal compliance — but these exceptions must be documented and communicated.
Designate a Data Protection contact (email or web form) on your website
Build a simple intake form for access, correction, and deletion requests
Define your identity verification process for rights requests
Set internal SLAs for responding to rights requests
Document exceptions to deletion (legal hold, contractual obligation)
Train customer-facing teams to recognise and escalate data rights requests
Test your rights request process end-to-end quarterly
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
