Operationalizing Data Principal Rights under Chapter III of DPDP Act 2023: Access, Correction, Erasure, and Grievance Workflows

I. I. The Statutory Shift to Individual Data Sovereignty

Chapter III (Sections 11 through 14) of the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) establishes a formidable catalog of statutory rights vested in Data Principals. In modern data privacy jurisprudence, these rights—commonly referred to in international enterprise compliance as Data Subject Requests (DSRs)—represent the legal mechanism through which citizens enforce sovereignty over their personal data.

Under the DPDP Act, responding to a DSR is not an optional customer service courtesy; it is a strict statutory duty. A Data Fiduciary that ignores, improperly refuses, or dilutes a Data Principal's lawful exercise of statutory rights faces regulatory complaints before the Data Protection Board of India and financial penalties up to INR 50 Crores under Paragraph 5 of the Schedule.

For commercial organizations managing millions of active digital user accounts, manually tracking and responding to DSRs is operationally impossible. Enterprises must engineer automated, auditable backend workflows to fulfill statutory rights within prescribed timelines.

II. II. Right to Access Information about Personal Data under Section 11

Under Section 11(1), the Data Principal has the statutory right to obtain from the Data Fiduciary to whom they have given consent or whose processing is grounded in Section 7 legitimate uses:

(a) A **Summary of Personal Data** being processed and the processing activities undertaken with respect to such personal data; (b) The **Identities of all other Data Fiduciaries and Data Processors** with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) Any other information related to the personal data of such Data Principal and its processing, as may be prescribed.

The requirement to disclose the specific identities of all third-party Data Processors and Fiduciaries represents a dramatic increase in corporate transparency. Enterprises cannot provide vague disclosures (such as 'shared with trusted marketing partners'); the enterprise must provide an exact, itemized inventory of recipient corporate entities.

III. III. Right to Correction and Erasure under Section 12

Section 12 of the DPDP Act codifies the twin rights of rectification and data destruction. Under Section 12(1), a Data Principal has the right to the correction, completion, and updating of their personal data.

Under Section 12(2), a Data Principal has the right to the **Erasure** of their personal data. Upon receiving an erasure request, the Data Fiduciary is statutorily mandated to erase the personal data, unless retention is necessary for the specified purpose or for compliance with any law.

Crucially, under Section 12(3), when a Data Fiduciary erases personal data, it must not only purge the records from its own production databases, but also cause its **Data Processors** to erase such personal data. This requirement demands automated event-driven webhooks that propagate erasure commands across cloud data warehouses, downstream API integrations, and backup repositories.

IV. IV. Statutory Exceptions to Erasure: Navigating Retention Conflicts

A critical legal challenge in operationalizing erasure requests is navigating statutory conflicts with mandatory retention laws. The right to erasure under Section 12 is not absolute; it is expressly conditioned on the phrase: 'unless retention of the same is necessary for the specified purpose for which its processing was specified or for compliance with any law for the time being in force.'

Enterprise legal teams must formulate clear statutory retention exceptions:

1. **Prevention of Money Laundering Act (PMLA) 2002**: Section 12 mandates that banking and fintech entities retain customer KYC records and transaction logs for a minimum of five years after the business relationship has terminated. 2. **Income Tax Act 1961 and Companies Act 2013**: Mandate retention of financial transaction records for eight years. 3. **Information Technology Act 2000 and CERT-In Directions**: Mandate retention of server system logs for 180 days. When an erasure request conflicts with a statutory retention obligation, the enterprise must deny erasure for the protected records, securely archive them, and provide a legally reasoned refusal notice to the Data Principal.

V. V. Institutional Grievance Redressal and Section 13 Obligations

Under Section 13, a Data Fiduciary must establish an accessible, transparent, and effective Grievance Redressal Mechanism. The Data Fiduciary must publish the contact details of the Grievance Officer on its website and mobile application.

The Data Principal must exhaust this internal grievance mechanism before approaching the Data Protection Board of India. The Grievance Officer must respond to complaints within such period as prescribed by the Central Government.

If the enterprise fails to provide a satisfactory response within the statutory timeline, or provides a frivolous dismissal, Section 13(3) empowers the Data Principal to escalate the matter directly to the DPBI, triggering a Section 27 regulatory inquiry.

VI. VI. Chambers Privacy Rights Governance Practice

Advocate Ritik Khurana Chambers counsels enterprise organizations, digital banking entities, and cloud platforms on architecting compliant Data Subject Request (DSR) workflows.

Our practice drafts institutional DSR Policies, formulates statutory refusal templates for PMLA/tax retention conflicts, and designs automated deletion verification protocols. In consumer privacy disputes and complaints filed before the DPBI, our team provides strategic defense, demonstrating statutory compliance and defeating frivolous claims.