Section 11 — Right to Access Information About Personal Data

Chapter III opens with access, and the right is scoped more narrowly than it might first appear. It runs against "the said Data Fiduciary" — one to whom the Data Principal has previously given consent, including the voluntary-provision consent described in Section 7(a). That means Section 11 gives a Data Principal a claim against a Fiduciary she has an actual consent relationship with; it isn't a general right to interrogate every organisation that happens to process her data under one of Section 7's other legitimate uses, where no consent was ever given in the first place.

A summary, not a database export — 11(1)(a)

A Data Principal can obtain a summary of the personal data being processed and the processing activities the Fiduciary has undertaken with it. The word "summary" is doing real work here: the right is about visibility into what's happening to the data and why, not a raw export of every underlying record with no context attached. A Fiduciary that hands over a table of database fields with no explanation of what they're used for hasn't really answered the request.

Naming who else has the data — 11(1)(b)

A Data Principal can also ask for the identities of every other Data Fiduciary and Data Processor her personal data has been shared with, along with a description of what was shared. This is a right she has to invoke, not something a Fiduciary has to volunteer upfront — the notice required before or with a consent request under Section 5 only has to describe the data being collected and the purpose, not name every downstream recipient in advance. "Trusted partners" language in a privacy policy doesn't substitute for actually answering this once asked; if a Fiduciary can't map which processors received which data for which purpose, it has no way to answer an 11(1)(b) request when one arrives.

Whatever else the Rules add — 11(1)(c)

Sub-section (1)(c) is an open clause reserved for any further categories of information the Rules choose to prescribe. Rule 14, notified so far, deals with the procedural mechanics of exercising rights rather than adding new categories of disclosure — so as things currently stand, (a) and (b) are where the substance of the access right actually lives.

The law-enforcement carve-out — 11(2)

Clauses (b) and (c) don't apply where the Fiduciary shared data with another Data Fiduciary that's authorised by law to obtain it, pursuant to a written request from that other Fiduciary made for preventing, detecting, investigating or prosecuting offences or cyber incidents. A Data Principal can still get her summary under (a); she just can't use (b) or (c) to force disclosure of an ongoing law-enforcement data-sharing arrangement.

The gap worth naming: no data portability

Chapter III — Sections 11 through 14 — covers access, correction and erasure, grievance redressal, and nomination. It stops there. Unlike GDPR's Article 20, nothing in the DPDP Act lets a Data Principal demand her data in a structured, machine-readable format to hand to a competing service. This is a deliberate legislative choice, not an oversight the Rules are expected to fix later — if portability matters to your product strategy or your users' expectations, it has to be handled as a design decision on top of the Act, not assumed as a statutory baseline the way it would be under GDPR.

How to actually make a request

Rule 14 requires a Data Fiduciary to prominently publish, on its website or app, the means by which a Data Principal can make a rights request and whatever identifying particulars — a username, customer ID, or similar identifier — it needs to verify who's asking. A Data Principal then exercises the right by using that published channel and supplying those particulars; there's no separate, informal route the Act expects a Fiduciary to also honour.

Illustration: a subscriber to a streaming service asks the company, through its published request channel, for a summary of the personal data it holds on her and a list of the processors it's shared that data with. The company must provide the summary and, on request, name the processors and describe what was shared — but it isn't obliged to hand her a downloadable file of her viewing history formatted for import into a competing service, because that's a portability right the Act doesn't create.

How Section 11 connects to the rest of the Act

Section 5's notice obligation and Section 7(a)'s voluntary-provision use both feed the consent relationship that triggers this right. Section 12 picks up immediately after access, giving the Data Principal correction and erasure rights over the same data; Section 13 gives her a grievance route if a Fiduciary doesn't answer an access request properly in the first place.