The Digital Personal Data Protection Act, 2023 (“DPDPA”) recognises the need for individuals to seek protection in respect of their personal data. The law provides certain rights to individuals to whom the personal data relates. These individuals are referred to as “data principals”.

If personal data relates to a child, the term “data principal” includes the child and their parents or lawful guardian. If personal data relates to a person with a disability, the term “data principal” includes the individual and the lawful guardian of such individual.

Data Principal Rights

Data principal rights are closely linked to the grounds relied upon by data fiduciaries to process personal data. Refer to our short guide on grounds of processing personal data for more information. Where the ground for processing personal data is consent or deemed consent evidenced by the data principal having voluntarily provided their data to a data fiduciary, data principals have the following rights:

• the right to access information on the processing activities undertaken with respect to their personal data. This does not imply an unconstrained right of the data principal to receive detailed information regarding the processing conducted by a data fiduciary, but rather a restricted right to obtain a summary of the personal data being processed and the processing activities undertaken by such data fiduciary, 
• the right to request the correction, completion, updating, and erasure of their personal data;

the right to withdraw consent to processing.