Right to access information about personal data
- Status
- Upcoming
- Applies from
- 13 May 2027G.S.R. 843(E)
- Penalty
- Up to Rs 50 croreSchedule, item 7
- Binds
- Every Data Fiduciary, for each Data Principal
In plain English
A person whose data is processed on consent, or for a State subsidy or service under s. 7(a) or (b), can ask the Data Fiduciary for a summary of the personal data being processed and the processing activities, the identities of every other fiduciary and processor the data was shared with and what was shared, and any other information the Rules prescribe. Sharing with another fiduciary authorised by law to obtain the data for crime prevention or detection is outside the right.
What you must do
Publish how a Data Principal makes a request, as Rule 14 requires, and answer within the period the Rules set.
Be able to produce a summary of the data and the list of fiduciaries and processors it was shared with.
Links marked Product, Service or Free tool are Infofacility's own.
Gazette text · s. 11The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—
- (1)The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,—
- (a)a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data;
- (b)the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and
- (c)any other information related to the personal data of such Data Principal and its processing, as may be prescribed.
- (a)
- (2)Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.
Source: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy)
Rules and tools that apply
Sources: Gazette of India, Act No. 22 of 2023, 11 Aug 2023 (MeitY copy); DPDP Act 2023, s. 11 · Change log