While the primary purpose of enactment of the Digital Personal Data Protection Act (“DPDPA”) is to form a robust framework pertaining to processing of personal information of individuals, it also lays down various rights and duties for data principals. While a number of global statutes prescribe rights of data principals, the DPDPA is one of the few statutes in the world which also prescribes duties of data principals.

Rights under the DPDPA

The DPDPA has prescribed the following rights available to data principals:

Right to access information about personal data: 

The data principal shall have the right to obtain the following from the data fiduciary in respect of personal data for which consent had previously been provided by the data principal:

1. summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
2. identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
3. any other information related to the personal data of such Data Principal and its processing.

Right to correction and erasure of personal data

The right enables the data principal to reach out to the data fiduciary for correction, completion, updating and erasure of her personal data for the processing of which they’ve previously given consent.

Upon receipt of a request (from a Data Principal) for erasure of the personal data, the Data Fiduciary shall be under an obligation to erase the personal data unless the retention of the same is necessary for the specified purpose or for compliance with any law.

Right of grievance redressal:

This right enables data principals to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of their rights.

The DPDPA further prescribes that the Data Principal shall be under an obligation to exhaust the opportunity of redressing their grievance with the Data Fiduciary or the Consent Manager before approaching the Data Protection Board of India.

Right to nominate

The Data Principals have also been provided the right to nominate any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal.

Penalty for violation of any of the rights of Data Principals

While the DPDPA doesn’t specifically prescribe any penalty for breach of rights of data principals, violation/non-provision of the rights of data principals by the Data Fiduciaries/Consent Manager will fall under the category of ‘breach of any provision of this Act’. In case of such a breach, the penalty prescribed under the DPDPA is such that it may extend to fifty crore rupees.

Duties under the DPDPA

The DPDPA prescribes that the data principals should comply with the following duties:

1. comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
2. to ensure not to impersonate another person while providing her personal data for a specified purpose;
3. to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
4. to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
5. to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.