India DPDPA: Article 11 – Right to access information about personal data
11. Right to access information about personal data
(1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—
(a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to suchpersonal data;
(b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
(c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
(2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.
What Article 11 Means for Your Business
Article 11 gives Data Principals the right to obtain information about their personal data from any Data Fiduciary that holds it. This is the DPDPA’s equivalent of the GDPR’s right of access, but with some specific requirements about the form and content of the response. Businesses must have processes in place to handle these requests promptly and accurately.
- Data Principals may request a summary of what personal data you hold about them and the processing activities undertaken on that data.
- Data Principals may request a list of all other Data Fiduciaries and processors with whom their personal data has been shared.
- Any grievance redressal mechanism you provide must be responsive, the Data Principal can escalate to the Data Protection Board if their complaint is not resolved satisfactorily.
- Build a structured Subject Access Request (SAR) handling process that can produce accurate responses within a reasonable timeframe, the rules prescribe specific response timelines.
- Ensure your data inventory and records of processing activities are sufficiently detailed to support accurate responses to access requests.