Module 4 of 9 · 6 min read
Rights of Data Principals — and the SLAs behind them
Access, correction, erasure, grievance and nomination — how to operationalise each.
The rights you must serve
| Right | What the Data Principal can ask | What you must be able to do |
|---|---|---|
| Access (s.11) | A summary of their personal data being processed, the processing activities, and the identities of all Fiduciaries/Processors it was shared with (unless shared for prevention/investigation of offences) | Produce a per-person report from the inventory — including downstream sharing |
| Correction, completion, updating, erasure (s.12) | Fix inaccurate or incomplete data; erase when no longer necessary for the purpose or required by law | Propagate corrections/erasure to Processors; keep a legal-hold register for exceptions |
| Grievance redressal (s.13) | A readily available means to complain to the Fiduciary (or Consent Manager) | A published channel, a response within the period set by the Rules, and escalation to the Board only after exhausting yours |
| Nominate (s.14) | Name a person to exercise their rights in case of death or incapacity | A nomination field and a verification process |
Rights are exercised through the means you specify in the notice, and you may verify identity before acting.
Retention and erasure under the Rules
- Erase when the specified purpose is no longer served or consent is withdrawn — whichever is earlier — unless a law requires retention.
- The Rules set a default period for named classes of Fiduciary (e.g., large e-commerce, online gaming and social-media intermediaries above user thresholds): if the Data Principal has not approached the Fiduciary for the purpose within 3 years, the purpose is deemed no longer served.
- You must notify the Data Principal at least 48 hours before such deletion so they can act to keep the account.
- Retain logs and the personal data needed to show compliance for at least one year after erasure.
Data Principal duties (s.15)
Principals must not impersonate, suppress material information, file frivolous grievances, or furnish false particulars — with a penalty of up to ₹10,000. Cite this in your grievance policy; it deters abuse.
Implementation checklist
- Rights request intake (web form + email) with identity verification
- Ticketing with SLA timers matching the Rules
- Data map that can answer "who did we share this with?"
- Erasure workflow that fans out to Processors and returns confirmations
- Nomination capture at onboarding and in profile settings