Sections 11–13 of the DPDP Act give your customers the right to a summary of their data, corrections, erasure and grievance redressal — and Rule 14 of the DPDP Rules 2025 requires you to publish how they can exercise those rights and how fast you respond. EasyDP gives customers a portal and gives you a queue, so nothing lands in a forgotten inbox.
DPDP Act 2023, Sections 11–13 · DPDP Rules 2025, Rule 14 · Updated July 2026
| No. | Obligation | What the Act says | Citation |
|---|---|---|---|
| 01 | Right to access | On request, you must provide a summary of the personal data being processed, the processing activities, and the identities of everyone the data was shared with. | Act · S.11 |
| 02 | Right to correction and erasure | Customers can demand correction of inaccurate data, completion, updating — and erasure once the purpose is served, unless another law requires retention. | Act · S.12 |
| 03 | Right to grievance redressal | You must offer a readily available means of grievance redressal, and the customer must use it before escalating to the Data Protection Board. | Act · S.13 |
| 04 | Published rights process and timelines | You must publish how a Data Principal exercises each right and the period within which you respond to grievances — then actually meet those timelines. | Rules · R.14 |
Customers open a short link — from your website footer, an SMS, or WhatsApp — verify themselves, and see their data. Requests are structured, not free-text emails.
Every request lands in a dashboard with its received date, your published deadline, and its state. The team sees exactly what is due this week.
Approve a request once and EasyDP applies it to the connected systems and records the completion — including the legal-retention carve-outs you configure.
Each request, response and completion is timestamped into the audit log — the record you produce if a grievance ever reaches the Board.
The Rules do not set one universal deadline — Rule 14 requires you to publish the time period within which you respond, and then meet it. Pick a period you can honour consistently (many businesses commit to 30 days) and state it in your privacy notice.
They can request erasure under Section 12, but you may retain data that another law requires you to keep — tax and accounting records under GST and income-tax law being the common example. You erase what is no longer legally required, and tell the customer what was retained and under which obligation.
The Act lets a Data Principal nominate another individual to exercise rights on their behalf in case of death or incapacity (Section 14), and parents or lawful guardians act for children and persons with disabilities.