DPDP Act Part 4: Rights, Duties, Children’s Data, Cross-Border & Exemptions

An ex-employee of a Gachibowli startup emails: “Tell me what personal data you still hold about me, who you shared it with, and delete what you don’t need.” From 13 May 2027, this is a statutory request. The startup must answer within 90 days, and it can only refuse erasure where a law requires retention.

The four rights of a Data Principal

1. Right to access information (section 11)

For data processed on consent (or under section 7(a)), a person can obtain:

• A summary of their personal data and the processing activities.
• The identities of all other Data Fiduciaries and Data Processors with whom it was shared, and a description of what was shared.
• Any other prescribed information.

Sharing with authorised law-enforcement agencies for preventing or investigating offences need not be disclosed (s.11(2)). To answer this request, you need a data map. That is why Part 5’s roadmap starts there.

2. Right to correction and erasure (section 12)

A person can ask you to correct inaccurate data, complete incomplete data, update it, or erase it. You must erase unless retention is necessary for the specified purpose or for compliance with law. Example: you can refuse to delete an invoice record that GST law requires you to keep, but you must delete the same customer’s marketing profile.

3. Right to grievance redressal (section 13)

You must provide a readily available means of redressing grievances and respond within the prescribed period, a maximum of 90 days under Rule 14(3). A person must exhaust this route before approaching the Data Protection Board (s.13(3)). A well-run grievance desk is your first line of defence against Board complaints.

4. Right to nominate (section 14)

A person can nominate someone to exercise their rights in the event of death or incapacity, for example an elderly customer nominating a child to manage their account data.

The five duties of a Data Principal (section 15)

The DPDP Act is unusual in placing duties on individuals. A person must comply with applicable laws, not impersonate anyone, not suppress material information when providing data for any document, identifier or proof of identity or address issued by the State, not file false or frivolous complaints, and furnish only verifiably authentic information when seeking correction or erasure. Breach can attract a penalty of up to ₹10,000. This gives businesses some protection against vexatious requests, though the penalty is decided by the Board, not by you.

Children and persons with disabilities: the special regime

For a child (under 18) or a person with a disability who has a lawful guardian, the Data Principal includes the parent or guardian. Verifiable consent from that parent or guardian is required (s.9(1)). Rule 10 lets you verify using reliable identity and age details you already hold, or details or a virtual token issued by an authorised entity, such as one mapped through DigiLocker.

Outside these, you cannot track, behaviourally monitor or target ads at children (s.9(3)). Edtech, gaming and kids’ consumer brands should treat age assurance as a product feature, not a legal footnote.

Cross-border data transfer (section 16)

The DPDP Act takes a “negative list” approach. You may transfer personal data outside India unless the Central Government notifies a country to which transfers are restricted (s.16(1)). As at 24 October 2026, no such restricted list had been notified (confirm). Rule 15 adds that transfers are subject to any requirements the Government specifies about making data available to a foreign State. Stricter sector laws continue to apply (s.16(2)).

For a startup on AWS Singapore or a manufacturer using a German ERP’s EU servers, this means transfers are currently permitted. You still owe all section 8 duties, and your processor contract must cover security and erasure.

Exemptions under section 17: when the Act steps back

For Hyderabad’s IT-services and GCC ecosystem: section 17(1)(d) matters most. Processing foreign clients’ customer data in India under contract is largely exempt, but security safeguards under s.8(5) still apply. Your own employees’ data remains fully covered.

Why work with ComplianceKart

Rights requests touch HR, tax-record retention and contracts at the same time. ComplianceKart is a boutique practice bringing CAs, CSs and advocates under one roof, like a multi-speciality hospital where the specialists confer before deciding the treatment. We help you set up request workflows, assess exemptions and draft cross-border processor clauses. We do not guarantee any regulatory outcome.

Frequently asked questions

Sources

• DPDP Act, 2023: sections 9, 11–17 — MeitY
• DPDP Rules, 2025: Rules 10, 12, 14, 15 and the Fourth Schedule (G.S.R. 846(E))
• PIB release on DPDP Rules, 14 November 2025 — pib.gov.in
• PIB, simplified compliance for start-ups, 3 December 2025 — pib.gov.in

Previous: Part 3 — security, breach and retention. Next: Part 5 — penalties, the Board and your roadmap.

This article is general information on the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as at 24 October 2026. It is not advice on any specific situation. Phased commencement dates and pending government notifications can change; check the official text on meity.gov.in before acting.