Sections 11-14 of DPDP Act 2023 establish the rights granted to Data Principals and Data Principal duties. Section 11 Right to Information: Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent + including consent as referred to in Section 7 (Legitimate Uses): (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared + along with a description of the personal data so shared; (c) any other information related to the personal data of such Data Principal and its processing as may be prescribed. Section 12 Right to Correction + Completion + Updation + Erasure: Data Principal shall have the right to correction + completion + updating and erasure of her personal data + to the extent reasonably possible + balanced against legitimate business purpose + retention obligation + statutory requirements. Section 13 Right of Grievance Redressal: Data Principal shall have the right to have readily available means of grievance redressal provided by Data Fiduciary or Consent Manager + before approaching the Board (DPBI) + Data Fiduciary or Consent Manager shall respond to any grievances within prescribed period (per DPDP Rules 2025 - typically 7 to 30 days). Section 14 Right to Nominate: Data Principal shall have the right to nominate any other individual who shall in the event of death or incapacity of the Data Principal exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder. Section 15 Duties of Data Principal: shall comply with the provisions of all applicable laws in any case to which she is referred to as Data Principal + shall not impersonate another person + shall not suppress any material information + shall not register a false or frivolous grievance or complaint with Data Fiduciary or the Board + shall furnish only such information as is verifiably authentic. Verification of Identity: Data Fiduciary may verify identity of Data Principal exercising rights to prevent fraud + impersonation. Operational implementation: customer rights portal + multi-channel intake + verification of identity (Aadhaar + PAN + KYC tier) + intake-to-resolution workflow + Service Level Agreement + statistics + reporting to DPBI + integration with grievance redressal mechanism per Sec 8(8). Coordinates with GDPR Arts 15-22 + Right to Information + Rectification + Erasure (Right to be Forgotten) + Data Portability (NOT in DPDP) + Objection (NOT in DPDP) + Automated Decision-Making (NOT explicitly in DPDP) + UK GDPR + Singapore PDPA + RBI Integrated Ombudsman Scheme 2021 + India Stack Customer Awareness. DPDP Sec 11-14 Data Principal Rights applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.