Sections 11–13 of the DPDP Act give your customers the right to a summary of their data, corrections, erasure and grievance redressal — and Rule 14 of the DPDP Rules 2025 requires you to publish how they can exercise those rights and how fast you respond. EasyDP gives customers a portal and gives you a queue, so nothing lands in a forgotten inbox.
DPDP Act 2023, Sections 11–13 · DPDP Rules 2025, Rule 14 · Updated July 2026
| No. | Obligation | What the Act says | Citation |
|---|---|---|---|
| 01 | Right to access | On request, you must provide a summary of the personal data being processed, the processing activities, and the identities of everyone the data was shared with. | Act · S.11 |
| 02 | Right to correction and erasure | Customers can demand correction of inaccurate data, completion, updating — and erasure once the purpose is served, unless another law requires retention. | Act · S.12 |
| 03 | Right to grievance redressal | You must offer a readily available means of grievance redressal, and the customer must use it before escalating to the Data Protection Board. | Act · S.13 |
| 04 | Published rights process and timelines | You must publish how a Data Principal exercises each right and the period within which you respond to grievances — then actually meet those timelines. | Rules · R.14 |
Customers open a short link — from your website footer, an SMS, or WhatsApp — verify themselves, and see their data. Requests are structured, not free-text emails.
Every request lands in a dashboard with its received date, your published deadline, and its state. The team sees exactly what is due this week.
Approve a request once and EasyDP applies it to the connected systems and records the completion — including the legal-retention carve-outs you configure.
Each request, response and completion is timestamped into the audit log — the record you produce if a grievance ever reaches the Board.
The Rules do not set one universal deadline — Rule 14 requires you to publish the time period within which you respond, and then meet it. Pick a period you can honour consistently (many businesses commit to 30 days) and state it in your privacy notice.