A PLAIN-ENGLISH GUIDE How a Data Principal Rights Management Platform Works From request to resolution: how organisations handle access, correction, erasure and grievance requests under the DPDP Act. Digital Personal Data Protection Act, 2023 | India How a Data Principal Rights Management Platform Works Page 2 Why Rights Requests Need a System Under India's Digital Personal Data Protection (DPDP) Act, 2023, every person whose data is collected, called a Data Principal , has legal rights over that data. The organisations that decide why and how the data is used, called Data Fiduciaries , must be ready to honour those rights. A Data Principal Rights Management Platform is software that helps an organisation receive, verify, track and complete these requests in one place, instead of juggling inboxes and spreadsheets. This guide explains, step by step, how such a platform works behind the scenes. What goes wrong without one • Requests get lost. They arrive by email, web form, phone and chat, and no one sees the full picture. • Data is hard to find. Personal data sits in many systems, so even one request can take days. • Deadlines slip. With no clear owner or due date, replies come late or not at all. • Proof is missing. When an auditor asks what was done, there is no clean record to show. In short: the law gives people rights. A platform turns those rights into a process that is simple, repeatable and easy to prove. The life of a request Whatever the request type, it follows the same journey from start to finish. Submitted Verified In progress Completed Closed Every request moves through clear statuses, so nothing is lost or forgotten. How a Data Principal Rights Management Platform Works Page 3 The Rights at a Glance The DPDP Act gives Data Principals several core rights. Here is what each one means and how a platform supports it. Right In plain words What the platform does Access to information Section 11 Know what personal data is held, why it is used and who it was shared with. Gathers details from connected systems and prepares a clear summary. Correction and erasure Section 12 Fix wrong or outdated data, or ask for it to be deleted when it is no longer needed. Sends the change to every system involved and confirms when it is done. Withdraw consent Section 6(4) Take back permission as easily as it was given. Stops the related processing and updates consent records. Grievance redressal Section 13 Raise a complaint and get a response within the set time. Logs the complaint, assigns an owner and tracks the deadline. Nominate someone Section 14 Name a person who can use these rights if you die or cannot act for yourself. Stores nominee details and handles their requests securely. Always refer to the Act and the DPDP Rules for exact wording, scope and response timelines. Why this matters Each right is simple to say but hard to deliver. Honouring an erasure request, for example, means finding the person's data in every system, deleting or anonymising it, and informing any vendor who holds a copy. A platform makes that chain of work visible and trackable. How a Data Principal Rights Management Platform Works Page 4 The Big Picture: Six Steps Most platforms follow the same six-step flow. Here is the overview, and the next pages explain each step. 1 Receive Request comes in one place 2 Verify Confirm who is asking 3 Classify Set type, owner and due date 4 Locate Find the data across systems 5 Fulfil Access, correct, erase, stop use 6 Respond Reply and keep an audit trail Think of it like a courier service. A parcel is received, checked, sorted, picked up, delivered and logged. A rights request deserves the same care, with tracking at every stop. What each step achieves • Receive: capture the request cleanly. • Verify: make sure the right person is asking. • Classify: decide what type it is, who owns it and when it is due. • Locate: find every place the person's data lives. • Fulfil: carry out the access, correction, erasure or consent change. • Respond: reply clearly and keep proof of the work. How a Data Principal Rights Management Platform Works Page 5 Steps 1 to 3: Getting Started 1 Receive the request The platform gives people one clear place to raise a request, such as a web form or portal. Requests sent by email or through support can also be logged in. A drop-down list of request types keeps everything specific, and an acknowledgement goes out straight away. Example: a customer picks “Delete my data” on a form and instantly receives a reference number. 2 Verify the requester Before anything is shared or removed, the platform confirms the requester is who they claim to be. This protects people from someone else trying to get at their data. Only the minimum information needed for the check should be collected. Example: a one-time password is sent to the phone number or email already on record. 3 Classify and assign The request is tagged by type, given an owner and a due date, and routed to the right team. The platform can also flag special cases, such as data that must be kept for legal reasons, so a person reviews them before any action. Example: an erasure request is routed to IT, while a complaint goes to the grievance officer. How a Data Principal Rights Management Platform Works Page 6 Steps 4 to 6: Getting It Done 4 Locate the data The platform searches connected systems, such as CRM tools, databases, cloud storage and vendor platforms, and builds a map of where this person's data lives. This is often the slowest part when done by hand. Example: a search by email address shows records in the CRM, billing system and newsletter tool. 5 Fulfil the request Tasks are created for every system involved. For access, the data is compiled into a readable summary. For correction, records are updated. For erasure, data is deleted or anonymised and vendors are told. For withdrawal of consent, related processing is stopped. Sensitive actions can need a manager's approval first. Example: IT marks each system as “done” and the platform shows overall progress. 6 Respond and record The requester receives a clear, plain-language reply and the request is closed. The platform keeps a time-stamped log of every action, who did it and when. This record is the proof that the organisation met its duties. Example: an auditor asks for a past request and the full history is exported in seconds. How a Data Principal Rights Management Platform Works Page 7 What Sits Behind the Scenes Under the hood, a rights platform connects four building blocks. Together they move a request from the outside world to your internal systems and back, with a record of everything. Intake Channels Web portal Email Mobile app Helpdesk Rights Workflow Identity check Request type Owner and deadline Approvals Connected Systems CRM Databases Cloud storage Vendor systems Proof and Reports Audit trail Status dashboard Reports Reminders Secure, role-based access and encryption across every step How the blocks work together • Intake channels collect requests from wherever people choose to make them. • The workflow engine checks identity, applies rules and sets owners and deadlines. • Connected systems are where the personal data actually lives and where changes are carried out. • Proof and reports keep everyone informed and ready for an audit. How a Data Principal Rights Management Platform Works Page 8 Manual Handling vs a Platform Many teams start with email and spreadsheets. That can work for a handful of requests, but it gets harder as volume and expectations grow. Task Manual handling With a platform Receiving requests Scattered across email, calls and forms One intake point for every channel Checking identity Done differently by each person Standard, repeatable verification Tracking deadlines Spreadsheets and memory Automatic due dates and reminders Finding the data Asking each team, one by one Connected systems searched together Correcting or deleting Manual edits, easy to miss a system Tasks sent to each system and confirmed Proof for audits Hard to piece together later Complete log of who did what and when Growing volume Needs more people and more time Scales with the same process The real gain is confidence. Teams know where every request stands, and leaders can show that each one was handled on time and on record. How a Data Principal Rights Management Platform Works Page 9 What to Look For If you are exploring options, this checklist covers the capabilities that matter most in day-to-day use. • One intake point for every channel • Role-based access and approvals • Flexible identity verification • A complete, exportable audit trail • Automatic deadlines and reminders • Clear, simple messages to the requester • Connectors to your key systems • Support for Indian languages • Support for vendors and processors • Dashboards for progress and workload Tips for a smooth start • Know your data first. A clear map of where personal data lives makes every request faster. • Name an owner. Decide who is responsible for rights requests and who backs them up. • Write in plain language. Short, friendly messages build trust with the people you serve. • Test with a few real cases. Run sample requests end to end before going live. Key takeaways Data Principals have clear rights. A rights management platform helps you receive each request, verify the requester, find the data, complete the work and keep proof, all within the time the law expects.