How to handle data access, correction and erasure requests under DPDP

To handle data requests under the DPDP Act, publish one clear way to ask, verify who is asking, search every system that holds the person's data, act on the request, and keep a record of what you did. The Digital Personal Data Protection Act, 2023 gives people rights to access, correct and erase their data, and a business can only honour them if it knows where the data lives. This is not legal advice. TechSum implements these workflows and partner counsel advises on legal interpretation.

What rights does the DPDP Act give people?

The Act calls the individual a Data Principal. The main rights are:

• Access (section 11): a summary of the personal data you process, the processing activities, and the identities of other Data Fiduciaries and Data Processors you have shared it with, along with a description of what was shared.
• Correction, completion and updating (section 12): where data is inaccurate or incomplete.
• Erasure (section 12): deletion of data that is no longer necessary for the purpose it was collected for, unless retention is needed by law.
• Grievance redressal (section 13): a route to raise a complaint with you before going to the Data Protection Board.
• Nomination (section 14): a right to name someone to exercise these rights if the person dies or becomes incapacitated.

Section 8(9) requires you to publish the business contact information of someone who can answer questions about personal data. Section 8(10) requires a grievance redressal system.

Why do requests go wrong?

Not because the rule is hard. They go wrong because the data is everywhere. One customer may sit in the website database, the CRM, an email marketing tool, WhatsApp chats, the accounting system, a payment gateway dashboard, a support inbox and a few exported spreadsheets. Someone asks for erasure and the team removes them from the CRM and forgets the rest.

The remedy is the data map from your first DPDP step (see what a small business must do first). A request process is that map turned into a checklist.

What does a workable process look like?

1. One front door: a page or a form named "Your data rights" and a published email address. Link it from your privacy notice and your footer. The notice should also explain how to complain to the Data Protection Board.
2. Acknowledge quickly: an automatic reply with a reference number and the expected response time.
3. Verify identity, proportionately: confirm the person is who they say they are before you release or delete anything. For a customer with an account, a login or a code sent to the registered email or phone is enough. Do not collect extra identity documents just to verify, because that creates more personal data to protect.
4. Search every system on the map: use a checklist with each tool named and an owner. Tick them off as searched.
5. Decide what you must keep: invoices and tax records may need to stay. Write down what you retain and why, so you can explain the decision.
6. Act: for access, prepare a readable summary, not a raw database dump. For correction, update every copy. For erasure, delete or anonymise in each system, and tell processors to do the same.
7. Reply in plain language: say what you did, what you kept and why, and how to complain if they are not satisfied.
8. Log it: date received, date answered, what changed, who handled it. This is your evidence if the Data Protection Board asks.

How should erasure handle backups and processors?

Backups are the awkward case. You usually cannot edit an immutable backup to remove one person. A practical approach is to document that backups roll off on a fixed schedule, ensure that erased data is not restored into live systems, and re-apply erasure if you ever restore from backup. Counsel can advise how this sits with the Act.

For processors, such as your email platform or cloud host, make sure the contract obliges them to delete on your instruction (section 8(2) requires you to engage processors only under a valid contract). Test that you know how to trigger deletion in each tool, because some do not offer it from the interface.

How should we answer the grievance side?

Treat grievances the same way: one place to send them, a named person, a reference number, a written reply. Many grievances are simple customer complaints about marketing messages or data shared without clear notice. Answering them well, and quickly, keeps most matters from reaching the Data Principal's next option, which is the Data Protection Board.

What are the trade-offs?

Manual handling works at low volume and fails quietly. A person can miss a system, or take too long. Automation costs build time and needs maintenance as tools change. Most small businesses should start manual with a good checklist, count how many requests come in over a few months, and decide from the numbers.

Identity checks create tension. Too light, and someone can request another person's data. Too heavy, and genuine requests stall. Verify against details you already hold.

Retention is the other tension. Every extra month you keep data is a month it can leak. Every month you delete early might cost you a record you needed. Settle retention periods per data type with counsel, then put them in code.

Where does TechSum fit?

We build the intake page, the verification step, the search across your systems, the deletion jobs and the log. Partner counsel advises on legal interpretation, such as what must be retained. The DPDP Readiness Scan shows how a request would play out in your current setup, and the DPDP Act compliance page describes the full work. See also the free health check and the Trust, Security and Compliance pillar.