How Should Businesses Respond to Personal Data Access Requests?

Businesses collect and process personal information through customer registrations, online purchases, employment records and digital services. Individuals increasingly want to understand what information organisations hold about them and how it is being used. A personal data access request allows an individual to seek information about the processing of their personal data and the organisations involved in handling it.

For Indian businesses, managing these requests is becoming an important part of data protection compliance. The Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a statutory right of access under Section 11. Although this provision is scheduled to commence in May 2027, businesses should begin preparing their systems and internal procedures now. A structured response process can help organisations protect individual rights, maintain transparency and reduce regulatory risks.

What Is a Personal Data Access Request?

A personal data access request is a formal request made by an individual seeking information about personal data held or processed by an organisation. For example, a customer may ask an e-commerce company what personal information it collects, how it uses the information and whether it shares the information with marketing agencies or payment service providers. Similarly, an employee may seek information about personal details maintained in an organisation’s human resources systems.

These requests are commonly referred to as Data Subject Access Requests (DSARs) under international privacy frameworks such as the European Union’s General Data Protection Regulation (GDPR). Under India’s DPDP framework, the individual is referred to as a Data Principal, while the organisation determining the purpose and means of processing is called a Data Fiduciary.

What Does the DPDP Act Say About Personal Data Access Rights?

Section 11 of the DPDP Act establishes the right to access information about personal data. It allows a Data Principal to obtain specified information from a Data Fiduciary to whom the individual has previously given consent, including consent relating to voluntarily provided personal data under Section 7(a).

The right covers three principal categories of information.

• First, a summary of personal data and processing activities. Individuals can seek a summary of the personal data being processed and the activities undertaken by the organisation in relation to it.
• Second, information about third party sharing. Organisations must identify other Data Fiduciaries and Data Processors with whom personal data has been shared, along with a description of the information shared.
• Third, other prescribed information. Individuals may also seek additional information concerning their personal data and its processing, as prescribed under the applicable rules.
• Section 11(2) provides a specific exception concerning information shared with another legally authorised Data Fiduciary following a written request for the prevention, detection or investigation of offences or cyber incidents, or prosecution or punishment of offences.

Importantly, the right under Section 11 is framed as a right to specified information and a summary of personal data. It should not automatically be interpreted as an unrestricted right to obtain every internal document, database record or business communication containing an individual’s details. The full provision is available in the Digital Personal Data Protection Act, 2023.

When Will the Access Request Provisions Become Applicable in India?

Businesses must understand the phased implementation of the DPDP Act and Rules. The DPDP Act received presidential assent on 11 August 2023. The Digital Personal Data Protection Rules, 2025 were subsequently notified on 13 November 2025.

However, Section 11 and Rule 14 are not scheduled to commence immediately. Under the commencement notifications, these provisions are scheduled to become effective eighteen months after publication in the Official Gazette, on 13 May 2027. Rule 14 specifically requires Data Fiduciaries and, where applicable, Consent Managers to publish the methods through which individuals can exercise their rights. It also permits organisations to specify reasonable identification particulars, such as a username, customer identification number or registered email address.

An important distinction concerns the 90 day period mentioned in Rule 14(3). This relates to the grievance redressal period which organisations must publish. It is not a universal 90 day deadline for completing every personal data access request. The official DPDP Rules notification provides the relevant implementation details.

How Should Businesses Handle Personal Data Access Requests?

A well designed request management procedure helps organisations respond accurately and consistently. Businesses should establish a process involving legal, compliance, customer support and information technology teams.

1. Establish a Clear Request Submission Process

Organisations should provide individuals with an accessible method to submit requests. This could include a dedicated privacy email address, an online request form or a designated section within a customer account. Under Rule 14, businesses will need to publish the available request methods prominently on their websites or applications when the provision becomes applicable. The process should explain the information required, the available communication channels and how individuals can track their requests.

2. Verify the Identity of the Requesting Individual

Before disclosing personal information, businesses should establish whether the request genuinely comes from the relevant individual or an authorised representative. Verification may involve checking a registered email address, customer identification number or existing account credentials. However, organisations should avoid collecting excessive identity documents. Verification measures should be proportionate to the sensitivity of the information and the risk of unauthorised disclosure. This step is particularly important where employee records, financial information or sensitive personal details are involved.

3. Identify and Collect Relevant Personal Data

Once a request has been authenticated, the organisation should identify the personal information associated with the individual. Information may be held across customer relationship management platforms, human resources databases, accounting systems, marketing applications and external service providers.

Businesses should coordinate with relevant departments to identify the information being processed and establish an accurate picture of their data handling activities. Maintaining an organised data inventory can make this process significantly easier.

4. Review Third Party Data Sharing

Under Section 11, businesses will need to identify other Data Fiduciaries and Data Processors with whom the individual’s personal data has been shared, along with a description of the information shared. This requires organisations to maintain accurate records of vendors, cloud service providers, payroll agencies, marketing partners and other relevant recipients. A vendor register and appropriate data processing agreements can help businesses prepare accurate responses.

5. Review the Information Before Disclosure

Before providing information, organisations should check whether the response contains personal information relating to other individuals or information protected by applicable legal restrictions. For example, an employee requesting access to employment records should not automatically receive confidential information concerning colleagues. Businesses should also consider the statutory exceptions and any applicable obligations concerning confidentiality, legal proceedings and regulatory disclosures.

6. Provide a Clear and Secure Response

Responses should be written in accessible language and organised in a manner which allows individuals to understand the information provided. Businesses should use secure communication channels, maintain a record of the response and document any information withheld or any limitation applied. An accurate response should explain the relevant processing activities rather than simply providing an unstructured collection of database extracts.

What Are the Existing Obligations Before Section 11 Commences?

Although the DPDP access right is scheduled for May 2027, businesses should not assume there are no existing obligations concerning personal information. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 contain relevant requirements. Rule 5(6) requires covered body corporates to permit individuals to review information they have provided and ensure personal information or sensitive personal data found to be inaccurate or deficient is corrected or amended, as feasible.

Rule 5(9) also requires a designated Grievance Officer to address grievances expeditiously and within one month of receipt. These provisions are narrower than the forthcoming Section 11 right. In particular, they do not establish an equivalent general right to obtain a summary of all personal data processing activities and third party sharing. The existing rules can be accessed through the WIPO Lex legal database.

What Happens If a Business Fails to Respond Properly?

Failure to establish an effective request handling process can create legal and operational risks. Once the relevant DPDP provisions commence, individuals will be able to exercise their statutory rights and approach the Data Protection Board of India through the applicable grievance and complaint mechanisms. Section 13 establishes the right to grievance redressal, while Section 27 provides for complaints to the Board in accordance with the statutory framework.

The Act also provides for financial penalties for specified contraventions. Businesses should therefore treat access requests as part of their broader privacy governance responsibilities rather than as routine customer service enquiries.

How Can Businesses Prepare for Future Access Requests?

Organisations should begin preparing well before the statutory commencement date. A practical starting point is to conduct a data mapping exercise to identify the personal information collected, its storage locations, processing purposes and third party recipients.Businesses should also review their privacy notices, vendor agreements, data retention policies and internal escalation procedures.

Training employees who handle customer complaints, HR enquiries and privacy communications is equally important. These teams should understand how to identify an access request and refer it to the appropriate compliance personnel. Seeking data privacy legal services can help organisations assess their existing obligations, develop appropriate request handling procedures and prepare for the DPDP framework. In addition, technology legal counsel can assist with reviewing data management systems, cloud arrangements, technology contracts and information security procedures relevant to access requests.

Conclusion

Personal data access requests are becoming an important element of corporate data protection and accountability. India’s DPDP Act introduces a statutory framework under which individuals can seek information about their personal data, processing activities and third-party sharing. Although Section 11 and Rule 14 are scheduled to commence on 13 May 2027, businesses should use the transition period to establish appropriate systems and internal procedures. Seeking advice from technology legal counsel can help organisations develop a well-structured response mechanism, improve transparency, strengthen customer confidence and prepare for India’s evolving data protection requirements.