InfraVeritas360DPDPiqDPDP Insights › The law › Sections 11–14 · Rule 14
The law
Sections 11–14 · Rule 14: Rights of people
People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
What it means in your sector
- Banking, financial services and insurance: Customers can ask for a summary of what you hold and who you shared it with: partner insurers, bureaus, collection agencies.
- Central government: ministries and departments: Citizens can ask for a summary of what is held. Correction rights apply; erasure on request does not.
- Public sector undertakings and utilities: Consumers can ask what you hold and who you shared it with.
- Healthcare and hospitals: Patients can ask what the hospital holds and who it was shared with, such as TPAs, insurers and labs.
Questions where this section matters
- What should our privacy notice say, and where must people see it?
- Someone asks what data we hold about them. What do we send?
- Someone asks us to delete their data. Must we?
- How do we handle a privacy complaint within 90 days?
- Do we need consent for employee data?
- Where does personal data live in our organisation?
- How much effort and time will it take to be ready by 13 May 2027?
- Must a ministry delete data when a citizen asks?
- Can we share patient records with insurers and TPAs?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.