India DPDPA: Article 15 – Duties of Data Principal
15. Duties of Data Principal
A Data Principal shall perform the following duties, namely:—
(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
(b) to ensure not to impersonate another person while providing her personal data for a specified purpose;
(c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
(d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
(e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.
What Article 15 Means for Your Business
Article 15 is unusual in data protection law, it places positive duties on the individuals whose data is being protected, not just the organisations processing it. Data Principals must not impersonate others, provide false information, make frivolous complaints, or suppress material information when exercising their rights. Breaches can result in penalties against the individual.
- Data Principals must comply with applicable laws when exercising rights under the DPDPA, they cannot use data rights as a mechanism to harass organisations or suppress legitimate processing.
- Providing false information to obtain access or correction of another person’s data is prohibited and carries a penalty of up to ₹10,000 on the Data Principal.
- For businesses, this provision provides some protection against bad-faith Subject Access Requests and frivolous complaints, document your legitimate grounds for declining such requests.
- This Article does not reduce your obligations as a Data Fiduciary, the existence of Data Principal duties does not allow you to refuse valid, good-faith rights requests.