Section 11 of the Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act of 2023, (DPDP Act) establishes a framework for the handling of personal data in India. One of the core components of the DPDP Act is the rights and duties of the Data Principal and the Data Fiduciary.

Chapter III of the DPDP Act outlines the rights and duties of the Data Principal. These rights are designed to empower individuals and give them control over their personal data. Section 11 of the DPDP Act provides for the right to access information about the personal data of the Data Principal.

As per Section 11(1) of the DPDP Act, the Data Principal possesses the right to request from the Data Fiduciary, to whom prior consent was granted, information pertaining to the processing of their personal data. Such requests shall be made in the prescribed manner as stipulated within the Digital Personal Data Protection Rules, 2025 (DPDP Rules).

According to Section 11(2) of the DPDP Act, the disclosure of personal data by a Data Fiduciary to another Data Fiduciary, legally authorized to receive such data, upon written request, is permissible for the purposes of prevention, detection, or investigation of offenses or cyber incidents, as well as for the prosecution or punishment of offenses.

In such an instance, the identity and description of personal data shared with the said Data Fiduciary shall not be disclosed to the Data Principal exercising its right under Section 11(1)(b) of the DPDP Act.

As per Rule 13 of the DPDP Rules, to facilitate the exercise of rights under the Digital Personal Data Protection Act, Data Fiduciaries and the Consent Manager, are required to publish the following information on their website or application, or both:

Pursuant to Rule 13(5) of the DPDP Act, an "identifier" is defined as any series of characters designated by the Data Fiduciary to uniquely identify a Data Principal. This may include, but is not limited to, a customer identification file number, customer acquisition form number, application reference number, enrollment ID, or license number, provided such identifier facilitates the aforementioned identification.

Section 11 of the Digital Personal Data Protection Act, 2023 (DPDP Act) grants Data Principals the right to access information regarding the processing of their personal data by Data Fiduciaries. This includes requesting a summary of processed data, identification of shared data recipients, and any additional relevant information. However, certain requests may be denied under specific circumstances, such as when disclosure would impede investigations or prosecutions. Data Fiduciaries are required to provide a clear process for submitting data requests through their websites or applications, including authentication requirements.