DPDP Act · Sections 11–14 · Rule 14
A data rights portal should make the next step clear
When someone asks what data you hold, requests a correction or raises a grievance, they should not have to guess where to write or whether anyone is handling it. A well-run portal gives people a clear route and gives your team a reliable way to follow through.
Keep the process understandable. Publish how to make a request and what identifier may be needed. Collect only what helps verify the requester and find the relevant records.
01 · The rights
Give each request a route to the right action
The DPDP Act gives Data Principals several rights connected to their personal data. A request process should help staff recognise what a person is asking for, locate the right records and send the case to someone who can decide it.
- Access information: request a summary of the personal data being processed and the processing activities, subject to the Act.
- Correction and completion: ask to correct inaccurate or misleading personal data, complete incomplete data, and update it.
- Erasure: request deletion, subject to applicable legal retention requirements.
- Grievance redressal: raise a concern through the Data Fiduciary’s published process.
- Nomination: nominate another individual to exercise rights in the event of death or incapacity, in accordance with the Act.
Separately, the Act requires a Data Fiduciary to inform affected Data Principals about a personal data breach in the manner prescribed. That notification duty belongs in your incident response process as well as your rights communications.
These rights have conditions and boundaries in the legislation. A portal should capture a request faithfully; trained staff should assess what the law requires in the circumstances.
See sections 11 to 14 of the Digital Personal Data Protection Act, 2023.
02 · Rule 14
Publish the request route and the grievance response window
Rule 14 focuses on making the process visible and usable. It does not prescribe one standard response deadline for every rights request.
Show how to submit a request
Prominently publish on your website or app the means a person can use to exercise their rights. The notice given under Rule 3 must also identify the relevant link or other means.
State any required identifier
If your terms of service require a username or another identifier to locate the Data Principal, publish the particulars needed. Avoid collecting extra identity documents by default.
Make the timeline reasonable
Publish the period for responding to grievances under your grievance redressal system. Rule 14 says that period must be reasonable and cannot exceed 90 days.
Rule 14(1) and (2) concern requests to the Data Fiduciary to whom the person previously gave consent; rights may also be exercised using the published means and identifiers. Review the Act and Rules for the scope and exceptions applying to your processing.
Source: Rule 14 of the DPDP Rules, 2025.
03 · Make it work
Design the whole journey, not just a form
A portal is useful when it connects the person’s request to the teams and systems that can resolve it. Map the journey from first contact through decision and response before choosing the form fields.
- Offer clear channels. Use a dedicated web form or email address, and explain any other available route in plain language.
- Classify the request. Let people describe what they need without forcing them to know legal section numbers. Staff can map it to access, correction, erasure, nomination or grievance workflows.
- Acknowledge receipt. Give a reference number and explain what happens next, including whether more information is genuinely needed.
- Assign an owner. Route the case to a named role and set internal reminders ahead of the published deadline.
- Find the relevant data. Identify systems, business teams and processors that may hold records for the person or purpose.
- Record the decision and reply. Keep the action taken, any lawful reason for limitation or refusal, the response date and follow-up history.
- Close the loop. Tell the person what was done in clear terms and provide the next grievance or escalation route when appropriate.
Keep separate stages for verification, data discovery, legal review and communication. That makes delays visible and helps teams see where a request is waiting.
04 · Trust and proportionality
Verify carefully and ask for less
The purpose of a check is to connect the request to the correct person and account. It should not become a reason to collect broad identity data that the request does not need.
Use identifiers people already know
Depending on your service, an account email, customer reference or other identifier may be enough to locate a record. Explain what you need and why before requesting it.
Escalate unusual cases
If details do not match, the request concerns another person, or a representative is acting for someone else, pause the workflow and use a documented review process. Do not disclose data until the authority and recipient are reasonably established.
Limit the information in case records to what is needed to manage the request, document the outcome and meet applicable obligations. Apply access controls and a retention period to the portal’s own records too.
05 · Grievance redressal
Keep the complaint path visible and accountable
Grievances need an owner, a published response period and enough context for a fair review. Rule 14 requires the period to be reasonable and no more than 90 days; it also calls for appropriate technical and organisational measures to support responses within that period.
- Publish the grievance channel and response period where people can find them.
- Track the date received, the issue raised, the responsible reviewer and key actions.
- Use reminders and escalation when a case approaches its due date.
- Make the final response understandable and preserve an appropriate record of how it was resolved.
- Explain the next step available under the Act where the person remains dissatisfied.
The Act requires a Data Principal to exhaust the opportunity to raise a grievance with the Data Fiduciary or Consent Manager before approaching the Board. The route should therefore be accessible and capable of producing a considered response.
Related reading: DPDP Act summary and compliance checklist.
06 · A distinct legal role
A rights portal is not automatically a Consent Manager
A request portal helps an organisation receive and manage rights requests. A Consent Manager is a separate role defined by the Act, with registration and obligations under the Rules.
Rights request portal
Supports communication between a Data Principal and the Data Fiduciary: request intake, identity checks, routing, due-date tracking and a record of the response.
Registered Consent Manager
Provides a Board-registered platform through which a Data Principal can give, manage, review and withdraw consent with participating Data Fiduciaries, subject to statutory conditions.
Do not describe an ordinary request-management feature as a registered Consent Manager. See the Act’s definition and Rule 4 and the First Schedule of the notified DPDP Rules.
07 · Phased commencement
When do these provisions take effect?
Sections 11 to 14 of the Act and Rule 14 are scheduled to commence eighteen months after the notification dated 13 November 2025. Other parts of the Act and Rules have different commencement dates.
Check the official commencement notification and the DPDP Rules, 2025.
Questions teams ask
DPDP data rights portal FAQs
What rights can a person exercise under the DPDP Act?
These include access to a summary of personal data and processing activities, correction, completion or updating, erasure subject to applicable law, grievance redressal and nomination. Separately, the Act requires notice to affected people about a personal data breach.
Is there a fixed deadline to answer every rights request?
No single response period applies to every rights request under the Act. Rule 14 requires a reasonable published period, not exceeding 90 days, for responding to grievances. Publish clear request channels and manage each case responsibly.
What should a request form ask?
Explain which request types are available, ask only for information needed to understand the request and identify the relevant person or account, and publish identifiers required under your terms of service.
Can I use one inbox for both requests and grievances?
You can use a shared intake channel if it is easy to find and requests are classified, assigned and tracked correctly. Make the grievance response period visible and ensure someone owns each case.
Is this the same as a Consent Manager?
No. A rights portal is a channel for requests and case management. A Consent Manager is a distinct role under the Act and Rules that requires registration with the Data Protection Board.
Make every request easier to follow through
Use the checklist to assign owners and evidence, then review how your organisation handles each request from receipt to reply.