The DPDP Act gives every person (the Data Principal) rights over the personal data you hold about them. This page explains those rights and how to handle requests with ConsentPlix.
The rights under the Act
| Section | Right | What the person can ask for |
|---|---|---|
| Section 11 | Right to information | A summary of the personal data you process and the processing activities, plus who you shared it with |
| Section 12 | Right to correction and erasure | Correct, complete or update their data, or erase data no longer needed |
| Section 13 | Right to grievance redressal | A response from you on any complaint before they go to the Data Protection Board |
| Section 14 | Right to nominate | Name someone to exercise their rights after death or incapacity |
How a request moves through ConsentPlix
- Submission. The person fills in a request form on your branded rights portal, for example
yourdomain.com/privacy/rights. - Identity check. Identifiers are hashed with your tenant salt, so plain-text personal data is not passed around your team.
- Deadline timer. A timer starts for the response window you set, so your team can see what is due and what is overdue.
- Assignment. The request is routed to your Data Protection Officer or grievance officer, and a
rights.submittedwebhook can open a ticket in your own system. - Resolution. When you fulfil the request, or refuse it under a valid exemption, ConsentPlix records the outcome and sends the person a signed confirmation.
Erasure and legal retention
Some laws require you to keep data even after an erasure request, for example RBI KYC or PMLA record-keeping rules for regulated financial entities. In that case ConsentPlix lets you mark the data as held under a legal obligation, stop all other processing, and record the reason, so you can show why it was not deleted.