Template · Rights response
Responding to an access, correction or erasure request
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A Data Principal may ask for a summary of their personal data and the processing, the identities of everyone it was shared with, correction or erasure. Rule 14 requires the means of asking to be published, the request to be verified, and a response within the period you publish, at most ninety days. Every response must repeat the Section 8(9) contact.
The three requests
Section 11: a summary of the personal data being processed and the processing activities, and the identities of all other Data Fiduciaries and Processors it has been shared with, with a description of the data shared. Section 12: correction, completion, updating, and erasure unless retention is required for the purpose or by law. Section 14 adds nomination.
What a checklist misses
A checklist asks whether a rights email address exists. The Act asks whether the response listed every processor the data went to, whether it arrived inside the published period, and whether it carried the contact of the person who answers questions about the processing, as Rule 9 requires.
What a compliant response has
- 01A published routeThe means of making a request, published, with what the person must include to identify themselves and the request.Rule 14(1), 14(2)
- 02VerificationA proportionate check that the requester is the Data Principal or their nominee, without collecting more data than needed.Rule 14(2), Section 14
- 03The summaryThe data held, the processing, and the identities of every Fiduciary and Processor it was shared with.Section 11(1)
- 04The actionCorrection made, erasure done, or the legal reason it cannot be, with the law named.Section 12(2), 12(3)
- 05ProcessorsConfirmation that processors were instructed to correct or erase too.Section 8(7), Section 12(3)
- 06Within the periodInside the period you publish, never beyond ninety days.Rule 14(3)
- 07The contactThe Section 8(9) contact repeated in the response.Rule 9
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Acknowledgement of a rights request. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
Acknowledgement of your access request
Right exercisedAccess
Date received1 June 2027
Identifier suppliedCustomer ID: CUST-40318
Received viaEmail
We are writing to confirm that we received your request on 1 June 2027. It has been recorded and is being dealt with.
Rule 14(3) of the Digital Personal Data Protection Rules 2025 requires us to respond within a reasonable period not exceeding ninety days. That period runs from the date we received your request, which means we will respond to you by 30 August 2027 at the latest. We will usually respond sooner.
What we understand you have asked for
A copy of everything you hold about me.
If we have misunderstood any part of this, please tell us and we will correct our record of your request.
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
For an erasure request that is granted.
Acknowledgement
We received your request on 10 September. We will respond within thirty days.
What we held
Your name, email address and the three enquiries you sent between March and June 2026. This data had been shared with our form provider and our email provider, both processors acting under contract.
What we did
We erased the data from our systems on 14 September and instructed both processors to erase their copies; they confirmed on 15 September. Billing records for your July invoice are retained for six years as tax law requires.
Contact
Questions about this response: [name], [email]. If you are not satisfied, you may complain to the Data Protection Board of India after using our grievance route.
Questions people ask
- Can we charge for a rights request?
- The Act does not provide for a fee. The response is part of the Fiduciary’s obligations.
- What if we cannot verify the requester?
- Ask for what is needed to verify, no more. Do not release data to someone you cannot confirm is the Data Principal.
- Must we tell them every vendor?
- Section 11(1)(b) requires the identities of all Data Fiduciaries and Processors the data was shared with, and a description of what was shared.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.