DPDP Insights › Questions › Someone asks what data we hold about them. What do we send?

Question

Someone asks what data we hold about them. What do we send?

Short answer: Yes, a clear summary, inside the published timeline

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

What the law says

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish.

Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
Section 8(9)–(10) · Rules 9, 14: Publish the business contact of a DPO or another person who can answer questions about personal data. Run a working grievance process and reply within a reasonable period, not more than 90 days.

Steps

Log the request in one register the day it arrives.
Verify identity using details you already hold.
Search every system, including vendors' copies.
Write a plain summary: what data, why it is used, who received it.
Send it, and file the request, search notes and reply.

Evidence to keep

Request register
Search notes for each request
Copy of each reply with date

Common mistakes

Sending raw database dumps
Forgetting data held by vendors
No identity check before sending

How it plays out by sector

Banking, financial services and insurance: The summary should list partner insurers, credit bureaus and collection agencies that received data.
IT, ITeS, BPO and GCC: Requests about client data go to the client. Requests from staff and candidates come to you.
Central government: ministries and departments: A beneficiary can ask what the department holds and who it was shared with, such as states and banks.
Public sector undertakings and utilities: Consumers can ask who received their data: distributors, franchisees, payment partners.
Healthcare and hospitals: Under the 2002 regulations, patients and authorised attendants should get record copies within 72 hours of a request. The DPDP summary adds who the data was shared with.

From each seat

DPO / Privacy lead: Requests land with you even when the data sits with other teams. Agree a turnaround with each system owner in advance, so you are not chasing people on day 25.
Operations head: Front-line staff receive most requests. Teach them to log the request and pass it on the same day, not to answer it themselves.
Branch / business head: People in your area hold data people may ask for. Know who logs a request and who searches.
HR department: Staff can ask what HR holds about them. Have the summary process ready.
Customer service department: Log every request on the day it comes in and route it to the DPO's register.

What a good answer from management sounds like

“Requests come into one register. We answer in well under our published time, and we can show every reply.” Effort and time: Medium · 6 to 8 weeks to set up.