Rights apply against a Data Fiduciary to whom you previously gave consent, including under section 7(a) (section 11, section 12).
- Access: a summary of your personal data and processing activities, the identities of other Data Fiduciaries and Data Processors it was shared with, and a description of what was shared (section 11).
- Correction and erasure: correction, completion, updating and erasure, unless retention is needed for the specified purpose or by law (section 12).
- Grievance redressal: readily available means of redress, with a response within a reasonable period not exceeding ninety days (section 13, rule 14). You must use this before approaching the Board.
- Nomination: nominate an individual to use your rights in case of death or incapacity (section 14).
- Withdraw consent at any time, as easily as you gave it (section 6).
How to use them
Use the method and identifiers the Data Fiduciary publishes on its website or app (rule 14).
Your duties
Do not impersonate others, do not suppress material information for State identity documents, do not file false or frivolous complaints, and give only verifiably authentic information for correction or erasure (section 15).
These rights come into force on 13 May 2027.