Short answer: From 13 May 2027, app users can ask for a summary of their data and the list of everyone it was shared with, have it corrected, completed, updated or erased, use a grievance route and nominate someone to act for them (ss.11 to 14). Rule 14 requires the app to publish how to make requests, and Rule 14(3) sets a 90-day ceiling for responses.
What rights do users have under the DPDP Act?
Users, called Data Principals, have the right to access information about their personal data, to correction, completion, updating and erasure, to grievance redressal, and to nominate another individual, plus the right to withdraw consent and to complain to the Data Protection Board (ss.11 to 14, s.6(4), s.27(1)(b)).
- Data Principal: the individual the personal data relates to, including a parent or lawful guardian for a child, and a lawful guardian for a person with disability (s.2(j)).
- Identifier: for rights requests, any sequence of characters the app issues to identify the user, such as a customer ID, email address or mobile number (Rule 14(5)).
The rights at a glance
| Right | Source | What the app must do |
|---|---|---|
| Access | s.11 | Provide a summary of data and processing, and the identities of every Data Fiduciary and Data Processor it was shared with, with a description of the data shared |
| Correction, completion, updating | s.12 | Correct inaccurate or misleading data, complete incomplete data, update data |
| Erasure | s.12 | Erase on request unless retention is necessary for the specified purpose or for legal compliance |
| Grievance redressal | s.13, Rule 14(3) | Provide a readily available means and respond within a published period of no more than 90 days |
| Nomination | s.14, Rule 14(4) | Let the user nominate someone to act on death or incapacity |
| Withdraw consent | s.6(4) | Make withdrawal as easy as giving consent |
| Complain to the Board | s.27(1)(b) | Available after the user exhausts the app's grievance route (s.13) |
Who does the access right apply to?
The access right applies to the Data Fiduciary to which the user gave consent, including where she voluntarily provided data under the s.7(a) legitimate use (s.11). There is an exception for sharing with authorities for the prevention or investigation of offences or cyber incidents.
- The duty to name every Data Fiduciary and Data Processor that received the user's data is the part most apps find hardest, because it covers SDK vendors and ad partners.
- Interpretation: s.11(1)(b) means an app should be able to name every SDK vendor and partner, fiduciary or processor, with which a given user's data was shared. See processors and SDKs.
How quickly must an app respond to a rights request?
Within a reasonable period that the app publishes, not exceeding 90 days (Rule 14(3)). The Gazette wording of Rule 14(3) is grammatically incomplete, but PIB's official explainer confirms the 90-day ceiling for access, correction, updating and erasure requests.
What must the app publish?
Rule 14 requires the app to publish prominently on its website or app:
- the means by which a user can make a request to exercise her rights (Rule 14(1), (2))
- the particulars, such as username, customer ID, email or mobile number, needed to identify her (Rule 14(1), (5))
- the period within which grievances will be answered (Rule 14(3))
Rule 9 adds that the business contact information of the DPO, or another person who can answer questions about processing, must be published and mentioned in every response to a rights request.
Do users have duties too?
Yes. Section 15 requires Data Principals to comply with the law, not impersonate anyone, not suppress material information when providing data for State identity documents, not file false or frivolous complaints, and furnish only verifiably authentic information when seeking correction or erasure. A breach carries a penalty of up to ₹10,000 (Schedule item 5).
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider an in-app privacy centre that handles access, correction, erasure, nomination and withdrawal from one place.
- A common approach is to accept requests using identifiers the user already has, such as the registered mobile number or email, as Rule 14(5) describes.
- Consider maintaining a live register of every SDK and partner that receives user data, so the s.11 list can be produced per user.
- Set an internal response target well inside 90 days and publish it.
- Include the DPO or contact person's details in every response, as Rule 9 requires.
- Check how erasure requests interact with the one-year log retention in Rule 8(3). See retention and erasure.
- Link the rights flow to your grievance process and track it in the readiness checklist.