Gevox
Start a scan
DPDP reference

Section 15

Duties of Data Principal

Places duties on the Data Principal, including not impersonating anyone and not filing frivolous complaints.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(a)
Comply with all applicable laws when exercising rights under the Act.
(b)
Do not impersonate another person when providing personal data for a specified purpose.
(c)
Do not suppress material information when providing personal data for a State-issued document.
(d)
Do not register a false or frivolous grievance or complaint.
(e)
Furnish only verifiably authentic information when exercising the right to correction or erasure.

In practice

This is the only penalty in the Act aimed at individuals, and at up to ten thousand rupees it is not a revenue measure. Its practical use is deterrent: the Board can also impose costs for false or frivolous complaints under s.28.

Read next

s.11Right to access information about personal dataGives the Data Principal the right to a summary of her data and the processing, and to know who it has been shared with.s.12Right to correction and erasure of personal dataGives the Data Principal the right to have her data corrected, completed, updated or erased.s.13Right of grievance redressalGives the Data Principal a right to readily available grievance redressal, and makes exhausting it a precondition to approaching the Board.Sch.PenaltiesThe seven penalty items the Board may impose under s.33(1), from Rs 250 crore for security failures down to Rs 10,000 for a Data Principal’s breach of duties.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 15 is live and carries its own penalty band. When the Board starts issuing orders under it, we will tell you what they actually turned on, cited.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy