Data Principal Self-Service Portal

What Is This Module For?

The Data Principal Portal enables your customers and users to directly exercise their DPDP rights — view their data, update their consent, and submit DSRs — without contacting your team.

Which Law Requires This?

• DPDP Act 2023, Section 12 — Data Principals have the right to access and correct their personal data. Providing a self-service portal reduces operational burden and demonstrates compliance.

Step-by-Step Guide

1. Go to My Portal settings in the sidebar.
2. Enable the portal and configure which modules are accessible to your data principals.
3. Set the portal URL — share this link with your customers in your privacy notice.
4. Data principals visit the portal, verify their identity (OTP to registered email), and can: view data held about them, update or withdraw consent, submit DSRs, and view DSR status.

Common Mistakes to Avoid

• Not enabling the portal at all — Many organisations collect personal data but never activate a self-service portal. Under DPDP Act Section 12, individuals have the right to access and correct their data — a portal is the most efficient way to honour this right at scale.
• Disabling DSR through the portal — The portal must support all rights: access, correction, erasure, and nomination. Do not restrict it to access-only.
• Not testing the portal link — Generate and test the portal token before sharing it with your customers. A broken link creates a poor experience and a compliance risk.
• Ignoring multilingual requirements — If your customers include non-English speakers, the portal must support the regional languages required by DPDP Rules 2025 Rule 3(1).

Frequently Asked Questions

Q: Is the portal mandatory?
A: Not explicitly mandated, but providing a clear mechanism for data principals to exercise rights is required. A self-service portal is the most efficient approach.

Q: Can data principals delete their account through the portal?
A: They can request erasure through the portal. Your team reviews and processes the erasure request, as some data may need to be retained for legal reasons.