DPDP Rules 2025 are now in effect. How ready is your business? Most Indian companies don't know yet.Find out in 10 minutes — free →
The rights framework in DPDPA is enforceable. Individuals can file complaints with the Data Protection Board if their rights requests are ignored or mishandled. For businesses, this means that a 'delete my data' email from a former customer is now a legal request with a response obligation, not an optional feedback message.
Businesses need a designated contact for data-related requests. They need a workflow to receive, verify, and resolve access and deletion requests. Response timelines must be built into operational procedures. Refusals must be documented with reasons.
The DPDPA grants Data Principals four core rights: (1) Right to access information about personal data being processed; (2) Right to correction and erasure of inaccurate or unnecessary data; (3) Right to grievance redressal through a designated contact at the organisation; and (4) Right to nominate someone to exercise these rights in case of death or incapacity. Businesses must designate a point of contact, establish a process to verify the identity of the requester, respond within the prescribed period, and document the outcome. Deletion requests may have exceptions — for example, where data is required for legal compliance — but these exceptions must be documented and communicated.
Designate a Data Protection contact (email or web form) on your website
Build a simple intake form for access, correction, and deletion requests
Define your identity verification process for rights requests
Set internal SLAs for responding to rights requests
Document exceptions to deletion (legal hold, contractual obligation)
Train customer-facing teams to recognise and escalate data rights requests
Test your rights request process end-to-end quarterly
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 10-minute industry assessment to find out your compliance risk level.
Take Free Assessment →2-min reads, plain English, every morning. Free forever.
