Prepared by Shubhank Suman, AI, Privacy, and IP Counsel
Ask most people what rights the DPDP Act gives them, and they would likely list access, correction, erasure, grievance redressal and nomination as one common set of rights available to every Data Principal against every Data Fiduciary. The text of Sections 11 to 14, however, points to a more nuanced position. Section 11 does not simply state that every Data Principal has a right to access her personal data. Instead, it specifically links the right to the Data Fiduciary “to whom she has previously given consent”, and expressly includes “consent as referred to in clause (a) of section 7”. This qualification is significant. It appears to cover two situations: first, consent given under Section 6 and second, the specific situation contemplated under Section 7(a), where the Data Principal has voluntarily provided her personal data for a specified purpose. In both cases, the processing is connected to an act or indication of the Data Principal. The same language is used again in Section 12, which deals with the rights of correction, completion, updating and erasure. The repeated reference to prior consent and Section 7(a), suggests that these rights were intended to operate in relation to consent-based processing, including processing falling under Section 7(a). Significantly, neither Section 11 nor Section 12 makes any corresponding reference to the other legitimate-use grounds under Section 7(b) to 7(i).
Section 13 and 14 whereas are written differently. They have used the term “Data Principals” and there is no reference to consent and 7a here. The right follows the data, not the basis on which it was collected. Therefore, It applies to any Data Principal, irrespective of the ground on which the processing takes place, including grounds other than consent and Section 7(a), since the provision makes no reference to consent and 7(a) as it does in section 11 and 12.
This becomes particularly significant in cases where processing is based on an independent legitimate-use ground. For example, where an employer processes an employee’s personal data for purposes connected with employment under Section 7(i), can the employee, as a Data Principal, still invoke the rights of access, correction and erasure under Sections 11 and 12?
Section | What it actually says | Who can invoke it |
|---|---|---|
Section 11(1) Right to access information | “The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request...” | Only a Data Principal who gave consent under Section 6, or provided her data voluntarily under Section 7(a) |
Section 12(1) Right to | “A Data Principal shall have the right to correction, completion, updating and erasure of | The same consent gate as Section 11, in the same words |
correction and erasure | her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law...” | |
Section 13(1) Right to grievance redressal | “A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal...” | It applies to any Data Principal, irrespective of the ground on which the processing takes place, including grounds other than consent and Section 7(a), since the provision makes no reference to consent and 7(a) as it does in section 11 and 12. |
Section 14(1) Right to nominate | “A Data Principal shall have the right to nominate...any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal...” | Any Data Principal, no reference to consent and 7(a) as it does in section 11 and 12. |
2. Why This Reads Like A Choice, Not An Accident
Parliament used the exact phrase "including consent as referred to in clause (a) of section 7" twice, in Sections 11 and 12, back to back. That is not language anyone reaches for by accident. It takes a conscious decision to treat Section 7(a) as a form of consent for this specific purpose, and an equally conscious decision to leave the other eight grounds in Section 7 out of it. Two sections later, in Sections 13 and 14, the same drafters had that exact phrase sitting two clauses behind them and chose not to use it again. If the intention had been for access and correction to reach every Data Principal, the easiest way to write that was the same open way Sections 13 and 14 are written. That did not happen.
Section 15, the duties provision, backs this up. It opens with "A Data Principal shall perform the following duties," no consent reference, applying to every Data Principal regardless of how her data came to be processed. So the pattern across this Chapter is consistent. Wherever Parliament wanted a provision to reach everyone, it wrote "a Data Principal" and stopped there. Wherever it wanted a provision to reach only the consent relationship, it added the qualifying phrase. Sections 11 and 12 got the qualifier. Sections 13, 14 and 15 did not.
3. Where This Leaves The Rest Of Section 7
Section 7 lists nine grounds on which a Data Fiduciary may process personal data. Only the first carries the word consent in the sense Sections 11 and 12 use it.
Clause | Ground for processing | Access & correction / erasure (Ss. 11, 12) | Grievance & nomination (Ss. 13, 14) |
|---|---|---|---|
7(a) | Voluntary provision of data for a specified purpose | Available | Available |
7(b) | State subsidy, benefit, service, licence or permit | Not available | Available |
7(c) | Performance of a State function, or sovereignty and security | Not available | Available |
7(d) | Disclosure obligation to the State under law | Not available | Available |
7(e) | Compliance with a judgment, decree or court order | Not available | Available |
7(f) | Responding to a medical emergency | Not available | Available |
7(g) | Public health measures during an epidemic | Not available | Available |
7(h) | Safety measures during a disaster or breakdown of public order | Not available | Available |
7(i) | Employment, including safeguarding the employer from loss | Not available | Available |
Take Section 7(i). An employer processing an employee's attendance record, performance rating or an internal investigation file under this clause is relying on a ground that has nothing to do with consent. On this reading, the employee has no textual route under Section 11 to demand a summary of what that file contains, and no route under Section 12 to have an inaccurate entry in it corrected, because the phrase that opens both sections was never written to reach her. She keeps her right to raise a grievance about how that data is handled under Section 13, and her right to nominate someone to act for her under Section 14 if she becomes incapacitated. What she does not have, on this text, is a right to see or edit the file itself.
The same reasoning applies to Section 7(b). A person whose data is pulled from an existing government database to check her eligibility for a subsidy has not consented to that specific use in any sense Section 11 recognises. She can complain if the department mishandles her data, but she has no textual basis under the Act to ask the department for a summary of what it holds on her or whom it has shared it with.
5. The Rule 14 Question, Answered
Rule 14 of the DPDP Rules, 2025 further supports this reading. Its heading is “Rights of Data Principals”, and sub-rule (1) broadly refers to enabling Data Principals to exercise their rights under the Act. More importantly, sub-rule (2) specifies the mechanism for exercising those rights by providing that a Data Principal may make a request to the Data Fiduciary “to whom she has previously given consent for processing of her personal data.” This is significant because the rule does not merely refer to a Data Fiduciary who processes the Data Principal’s personal data; it specifically identifies a Data Fiduciary to whom the Data Principal has previously given consent.
Read alongside Sections 11 and 12, this wording reinforces the view that the rights of access, correction and erasure are tied to a prior consent relationship. In other words, where personal data is processed without the Data Principal’s consent, including where processing is based solely on an independent legitimate-use ground under Section 7, the Data Principal may not be able to invoke Sections 11 and 12. Rule 14(2) therefore appears to reflect and reinforce the distinction already present in the Act, the rights of access, correction and erasure operate in relation to a Data Fiduciary to whom the Data Principal has previously given consent, whereas the rights under Sections 13 and 14 are not similarly qualified by a consent requirement.