Duties of Data Principals under the DPDP Act (section 15)

Audience: support and trust teams, compliance owners, founders, individuals · Last reviewed: October 2026

Most DPDP guidance focuses on what businesses must do. Chapter III of the Act also sets out what individuals must do. Section 15 is short, but it affects how you design identity checks, correction workflows and complaint handling. This guide explains each duty, who enforces it, and the limits on how businesses can use it.

The five duties

1. Comply with applicable laws when exercising rights

A Data Principal must comply with all applicable laws while exercising her rights under the Act (section 15(a)). Rights are exercised within the legal system, not outside it.

2. Do not impersonate another person

She must ensure she does not impersonate another person while providing her personal data for a specified purpose (section 15(b)). For businesses, this is why reasonable identity checks on sign-up and on rights requests make sense.

3. Do not suppress material information for official documents

She must not suppress any material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities (section 15(c)). This duty is aimed at government-issued documents and identifiers.

4. Do not register false or frivolous grievances or complaints

She must not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board (section 15(d)). Separately, if the Board finds at any stage that a complaint is false or frivolous, it may issue a warning or impose costs on the complainant (section 28(12)).

5. Give only verifiably authentic information when correcting or erasing

When exercising the right to correction or erasure, she must furnish only information that is verifiably authentic (section 15(e)). This sits alongside section 12, which gives the right to correction, completion, updating and erasure.

The penalty and who imposes it

Item 5 of the Schedule to the Act provides that breach of the duties under section 15 may attract a penalty that may extend to ten thousand rupees. Only the Data Protection Board imposes penalties, and only after an inquiry where it finds the breach significant and gives the person a hearing (section 33(1)). A business cannot fine a user, and should not imply it can.

What section 15 does not let businesses do

• It does not shift your obligations. Section 8(1) says the Data Fiduciary is responsible for complying with the Act “irrespective of any agreement to the contrary or failure of a Data Principal to carry out the duties provided under this Act”.
• It does not let you make users waive rights. Any part of a consent that infringes the Act is invalid; the Act's own illustration is a waiver of the right to complain to the Board (section 6(2)).
• It does not let you ignore a grievance you think is weak. You must still run an effective grievance mechanism (section 8(10)) and respond within your published period, which may not exceed ninety days (section 13(2); Rule 14(3)).

How to reflect section 15 in your workflows

1. Proportionate verification. Rule 14(1)(b) lets you publish the identifiers (such as a username, email address or customer number) needed to identify a requester, and Rule 14(2) says she makes a request using the means and particulars you require. Ask for what you need to match the account, not more.
2. Evidence for corrections. For changes to important fields, ask for supporting information that lets you check authenticity (section 15(e)), and record what you relied on. Correction is subject to any requirement or procedure under other applicable law (section 12(1)).
3. Log every grievance. Record the grievance, your response and the date. If a matter reaches the Board, your records show what happened; remember the Data Principal must first exhaust your grievance process (section 13(3)).
4. Neutral language. Do not threaten penalties in templates. If you suspect impersonation, decline to act on that request, explain what verification is needed, and escalate internally.

For the rights side of the same workflows, see Data Principal rights explained, access and correction requests, and grievance redressal under DPDP. Our privacy complaints guide covers escalation.

When section 15 applies

Section 15 is among the provisions brought into force eighteen months from 13 November 2025 under the commencement notification noted at section 1(2).

Frequently asked questions

What are the duties of a Data Principal under the DPDP Act?

Section 15 lists five: comply with applicable laws when exercising rights; do not impersonate another person; do not suppress material information for State-issued documents, identifiers or proofs of identity or address; do not register false or frivolous grievances or complaints; and furnish only verifiably authentic information when seeking correction or erasure.

What is the penalty for a Data Principal who breaches section 15?

Item 5 of the Schedule to the Act provides for a penalty that may extend to ten thousand rupees. Only the Data Protection Board can impose it, after an inquiry and a hearing (section 33(1)).

Can a company refuse a request because the user breached a duty?

Section 8(1) makes the Data Fiduciary responsible for compliance irrespective of a Data Principal's failure to carry out her duties. A company can require the identifiers and particulars it publishes under Rule 14 to verify a request, but cannot treat section 15 as a general excuse to stop complying.

What happens if someone files a false complaint with the Board?

Section 28(12) allows the Board, at any stage after receiving a complaint, to issue a warning or impose costs on the complainant if it considers the complaint false or frivolous. Section 15(d) also makes filing such a complaint a breach of duty.