What Is This Module For?
The DSR module helps you manage requests from individuals (Data Principals) exercising rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) — rights to access, correct, erase, and nominate, as defined in Sections 11–14.
Which Law Requires This?
- DPDP Act 2023, Section 11 — Right to access information about personal data processed.
- DPDP Act 2023, Section 12 — Right to correction and erasure.
- DPDP Act 2023, Section 13 — Right to grievance redressal.
- DPDP Act 2023, Section 14 — Right of nomination.
- DPDP Rules 2025, Rule 7 — Response within 30 days of verification; 7 days for urgent requests.
Penalty: Failure to respond within the statutory timeline can attract penalties up to ₹10,000 per instance under DPDP Act Section 25.
Who Should Use This Module?
The DPO or Legal/Compliance team — anyone responsible for responding to data subject rights requests.
Step-by-Step Guide
- Go to Data Subject Requests in the sidebar.
- View incoming requests — filter by type (Access, Correction, Erasure, Nomination) or status.
- Verify the requester — dcomply sends an OTP/link to the requester's email automatically.
- Assign the request to a team member. They receive an email notification.
- Process the request — record actions taken, upload supporting documents.
- Respond to the requester using built-in response templates. The system records the response date.
- Close the request — the audit log is automatically preserved for 3 years.
Common Mistakes to Avoid
- Not documenting the response — Always record what action you took, not just that you responded.
- Ignoring Nomination requests — Section 14 requires you to accept a Data Principal's nominee.
- Missing the appeal window — Grievances under Section 13 must be responded to within 30 days.
Frequently Asked Questions
Q: Can we reject a DSR?
A: Yes, but only on specific grounds permitted by the DPDP Act (legal obligation, national security, etc.). Document the legal basis for rejection.
Q: How long do we keep DSR records?
A: DPDP Rules 2025 require a minimum 3-year audit log. dcomply retains these automatically.