Section 11: Right to Access Information About Personal Data

Statutory Text (Official Gazette)

(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—

• (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
• (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
• (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed.

(2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.

What Section 11 Means in Plain English

Section 11 gives every Data Principal the right to look behind the curtain of your application. When an individual submits a data access request, your business must be able to provide:

1. A summary of all data collected: Exactly what profile details, log records, and analytics attributes exist in your databases.
2. The activities performed on that data: What your algorithms and backend services did with the information (e.g. ad targeting, risk scoring, order fulfillment).
3. The full list of third parties who received the data: You must name every SaaS tool, analytics vendor, or partner company with whom you shared their personal data, along with what specific data points were transmitted.

Engineering Checklist

• Data Principal Rights Portal: Provide an authenticated web page where users can submit statutory access requests.
• Third-party data lineage map: Maintain an accurate inventory of downstream tools receiving user data (e.g., Salesforce, Mixpanel, Google Ads, Stripe).
• Automated data export pipeline: Build export tools (JSON / PDF) that can compile a user’s records quickly. The Act sets no fixed deadline for access requests, but Rule 14 requires you to publish how to make a request, and grievances about unanswered requests must be handled within your published period of no more than 90 days.