Section 15: Duties of Data Principal

Statutory Text (Official Gazette)

A Data Principal shall perform the following duties, namely:

• (a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
• (b) to ensure not to impersonate another person while providing her personal data for a specified purpose;
• (c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
• (d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
• (e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.

What Section 15 Means in Plain English

India’s DPDP Act is unique among global data protection frameworks because it creates enforceable legal duties for individuals (users) alongside their rights:

1. No identity fraud or impersonation: Signing up using someone else’s name, email, or credentials violates Section 15(b).
2. No false or frivolous complaints: Section 15(d) bars registering false or frivolous grievances or complaints with a business or the Board. Separately, Section 28(12) lets the Board warn or impose costs on someone whose complaint it finds false or frivolous.
3. Statutory user fine (Up to ₹10,000): Under item 5 of the Schedule, the Data Protection Board can penalize a malicious user up to ₹10,000 for registering fraudulent claims or impersonating someone else.