top of page
Search

How to Advise a Data Principal on Her Duties Under Section 15 of the DPDP Act

Writer: Kaustav Chowdhury
Kaustav Chowdhury
1 day ago
5 min read

Updated: 5 hours ago

Almost every account of the Digital Personal Data Protection Act, 2023 is written from the fiduciary's side. Section 15 runs the other way. The duties under section 15 bind the data principal herself, and a breach of them carries the one penalty in the Act aimed at an individual rather than at an organisation. A complaint is therefore not a costless act, and the advice given before one is filed should say so.

Step 1: Fix the Commencement Position

Section 15 sits within sections 7 to 17, which come into force eighteen months after publication of the commencement notification G.S.R. 843(E) dated November 13, 2025, falling in May 2027. The duties are not yet operative, and neither is the Schedule entry that sanctions them.

The advisory point survives the timing. Clients who intend to complain, and clients who collect personal data from individuals, both need to know that the Act places duties on the individual, because almost nothing written about the Act says so.

Step 2: Take the Four Duties in Order

Clause (a) requires the data principal to comply with the provisions of all applicable laws for the time being in force while exercising her rights under the Act. Clause (b) requires her to ensure not to impersonate another person while providing her personal data for a specified purpose. Clause (c) requires her to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities. Clause (d) requires her to ensure not to register a false or frivolous grievance or complaint with a data fiduciary or the Board.

Read together, three of the four are duties of candour in dealing with a fiduciary, and the fourth is a duty of restraint in dealing with the complaint machinery. Neither is a qualification on her rights, which remain exercisable; they are obligations that sit alongside them.

Step 3: Treat Impersonation as the Identity Duty

Clause (b) attaches to the act of providing personal data for a specified purpose. The duty is not to impersonate another person in that act, which is narrower than a general duty of honesty and wider than a duty not to commit fraud.

In practice this is the clause that bites where one family member transacts in another's name, which is common and is usually done without any intention to deceive. Where a client routinely acts for a relative, the right advice is to use whatever authorised representative or guardian route the fiduciary offers rather than to submit the relative's details as her own.

Step 4: Treat Suppression as the Disclosure Duty

Clause (c) is narrower than it first looks. It is directed at suppression while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities, so a purely private form is outside it. Materiality is not defined and carries its ordinary meaning, which is information that would matter to the decision the document is sought for.

The honest advice is that an omission made to improve an outcome is the paradigm case. Where a client is unsure whether something is material, the safer course is disclosure with an explanation, because the duty is framed as an obligation to ensure that suppression does not happen rather than as a prohibition on deliberate concealment.

Step 5: Explain the False or Frivolous Complaint Duty Properly

Clause (d) is the duty most likely to be engaged by the very step a client is about to take. It covers a grievance registered with a data fiduciary as well as a complaint to the Board, so it applies from the first internal escalation and not only at the Board's door.

False and frivolous are different things. False goes to the truth of what is alleged, and frivolous goes to whether the complaint is worth deciding at all. A complaint that is accurate but trivial, and a complaint that is serious but unfounded, are each capable of falling within the clause, and a client should be told which risk its complaint runs.

Step 6: Put the Two Consequences Side by Side

The Schedule to the Act provides for a penalty that may extend to ten thousand rupees for breach in observance of the duties under section 15. Separately, section 28(12) allows the Board, at any stage, where it concludes that a complaint is false or frivolous, to warn the complainant or impose costs on her.

So the exposure is two headed and the heads are independent. The Schedule entry is a penalty for breach of the duty, and the costs power is an incident of the proceeding. A client weighing a complaint should be told about both, and should be told that the monetary scale of the first is modest while the reputational effect of either finding is not.

Step 7: Record the Advice on the File

Because the risk attaches to the client's own conduct, the protection is the record. Before a complaint is filed, record what the client says happened, the material she relies on, what was checked, and what she was told about clauses (c) and (d).

Keep it proportionate to the complaint. A note of the instructions and the documents seen is enough for most matters, and it is the difference between a complaint that turns out to be wrong and a complaint that looks as though it was never grounded.

Common Pitfalls to Avoid

  • Advising as though the Act only binds fiduciaries: Section 15 places four duties on the data principal herself.

  • Treating the duties as presently operative: Section 15 falls within sections 7 to 17 and commences with the eighteen month tranche.

  • Reading the duties as cutting down the rights: They sit alongside the rights rather than qualifying them.

  • Thinking clause (d) applies only at the Board: It covers a grievance registered with a data fiduciary as well as a complaint to the Board.

  • Collapsing false into frivolous: One goes to the truth of the allegation and the other to whether it is worth deciding.

  • Quoting only the Schedule: Section 28(12) gives the Board a separate power to warn a complainant or impose costs.

  • Filing without a record: The duties attach to the client's own conduct, so the contemporaneous note is the protection.

Key Statutory Provisions

  • Section 15 of the Digital Personal Data Protection Act, 2023: The duties of a data principal, being to comply with applicable laws while exercising her rights, not to impersonate another person while providing her personal data for a specified purpose, not to suppress material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities, and not to register a false or frivolous grievance or complaint with a data fiduciary or the Board.

  • The Schedule to the Act: A penalty that may extend to ten thousand rupees for breach in observance of the duties under section 15, which is the only entry in the Schedule directed at an individual rather than at an organisation.

  • Section 28 of the Act: Sub-section (12) allows the Board at any stage, on concluding that a complaint is false or frivolous, to warn the complainant or impose costs on her.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page