Data Subject Access Request(DSAR) Management: A DPDP Act, 2023 Perspective

In the era of data-driven businesses, individuals are becoming more conscious of their digital rights. The Digital Personal Data Protection (DPDP) Act, 2023, strengthens these rights by granting Data Principals the ability to access, correct, erase, and manage their personal data through Data Subject Access Requests (DSARs). This blog explores DSAR management in the context of the DPDP Act, outlining key provisions, exemptions, and best practices for organizations.

Understanding DSAR and Its Importance

A Data Subject Access Request (DSAR) is a request submitted by an individual to an organization (Data Fiduciary) to access or modify their personal data. Effective DSAR management is crucial for regulatory compliance, building consumer trust, and ensuring data transparency.

Key DSAR Rights Under the DPDP Act, 2023

The DPDP Act, 2023, provides Data Principals with the following rights:

1. Right to Access Information (Section 11):
   • Individuals can request a summary of their personal data, details of its processing, and information on third-party sharing.
2. Right to Correction & Erasure (Section 12):
   • Data Principals can request corrections, updates, or erasure of their personal data, subject to legal or regulatory retention requirements.
3. Right to Grievance Redressal (Section 13):
   • If a DSAR is denied, individuals can file a grievance, and organizations must respond within a prescribed timeframe.
4. Right to Nominate (Section 14):
   • In case of death or incapacity, Data Principals can nominate a representative to exercise their rights.

Exemptions & Limitations Under DPDP Act (Section 17)

Organizations may deny DSARs under certain conditions, such as:

• Legal Claims: If data processing is necessary for legal defense or compliance with judicial orders.
• Law Enforcement Requests: If personal data is required for crime prevention or national security.
• Regulatory & Supervisory Functions: When data is used by courts, tribunals, or regulators.
• Corporate Transactions: In cases of mergers, acquisitions, or financial assessments.

DSAR Management Workflow

To ensure compliance, organizations should adopt a structured DSAR handling process:

1. Receiving & Verifying Requests: Authenticate the requestor to prevent unauthorized access.
2. Locating & Reviewing Data: Identify relevant personal data across internal systems.
3. Applying Exemptions: Assess whether any legal exceptions apply.
4. Responding to the Data Principal: Provide requested data securely and within the prescribed timeframe.
5. Maintaining Records: Keep detailed logs for audit and compliance purposes.

Best Practices for DSAR Compliance

• Automate DSAR Management: Use privacy management tools for efficient request handling.
• Centralized Data Inventory: Maintain a structured database to locate personal data quickly.
• Secure Verification Process: Authenticate requests to prevent fraudulent access.
• Employee Training: Educate staff on DSAR handling and regulatory compliance.
• Secure Communication Channels: Ensure encrypted transmission of DSAR responses to avoid data leaks.

Proper DSAR management is essential for compliance with the DPDP Act, 2023, and for fostering trust in an organization’s data protection practices. By adopting automated workflows, clear policies, and proactive compliance measures, businesses can effectively handle DSARs while minimizing legal and operational risks.

‍