The Act gives data principals rights against data fiduciaries: to get a summary of their data and how it is processed, to correct or complete it, to have it erased when it is no longer needed or consent is withdrawn, to nominate someone to act for them, and to have grievances addressed. For a child, the parent or lawful guardian acts as the data principal’s representative.
Data principals have duties too — for example, not to file false or frivolous complaints or impersonate someone else. For a brokerage, the practical point is to be able to find everything held about one person (calls, chats, notes, documents), correct it, and delete it on request, across every tool where it is stored.
Example
An erasure request (illustrative)
A tenant who rented in Bengaluru through a broker two years ago emails asking for her data to be deleted. The broker checks for any legal duty to retain records (for example, tax records of the brokerage invoice), keeps only what is required, deletes her chats, call notes and documents from the CRM and tells the SMS provider to stop, and replies with what was deleted.
Questions about Data principal
What rights does a data principal have under the DPDP Act?
The right to access information about their data and its processing, to correction and erasure, to grievance redressal, and to nominate another person to exercise these rights after death or incapacity. They can also withdraw consent at any time. Check the Act and rules for details.
Must a broker delete data when asked?
Generally yes, once consent is withdrawn or the purpose is served, unless a law requires the data to be kept, such as tax records. Delete from processors too. This is general information, not legal advice; refer to the Act and the DPDP Rules.
Sources
See also
Reviewed