The Act doesn't only place obligations on organisations. Five duties bind the Data Principal too, and they exist to keep the rights regime from becoming cover for fraud, not to burden ordinary requests.
15. A Data Principal shall perform the following duties, namely:—
(a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act;
(b) to ensure not to impersonate another person while providing her personal data for a specified purpose;
(c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
(d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and
(e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.
Every section before this one in Chapter III describes something a Data Principal can demand of a Data Fiduciary. Section 15 turns that around: it sets five duties a Data Principal must observe while exercising those very rights. None of them are onerous for someone acting in good faith — they're aimed squarely at the narrow set of cases where the rights regime itself gets misused.
A Data Principal must: (a) comply with the provisions of all other applicable laws while exercising rights under the Act; (b) ensure she does not impersonate another person while providing her personal data for a specified purpose; (c) ensure she does not suppress material information while providing personal data for a document, unique identifier, proof of identity, or proof of address issued by the State or any of its instrumentalities; (d) ensure she does not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and (e) furnish only information that is verifiably authentic while exercising the right to correction or erasure.
Read together, the five duties target a consistent theme: using the rights framework as a vehicle for fraud or bad faith, rather than for its intended purpose. Impersonation (b) and suppression of material information on government-issued documents (c) are about the integrity of identity and proof-of-address processes that DPDP rights could otherwise be used to game. A false or frivolous complaint (d) targets abuse of the grievance and Board-complaint machinery Sections 13 and 33 set up. And furnishing only verifiably authentic information when correcting or erasing data (e) closes the obvious loophole of using a "correction" request to insert false information rather than fix a genuine inaccuracy.
The Schedule to the Act treats any breach of a Section 15 duty as a single category, carrying a penalty that may extend to ₹10,000. That figure is worth putting next to the corporate side of the Schedule: up to ₹250 crore for a security-safeguards failure under Section 8(5), up to ₹200 crore for a children's-data breach under Section 9, and up to ₹150 crore for a Significant Data Fiduciary's failure under Section 10. The gap is intentional — Section 15 is meant to deter bad-faith use of the rights and complaints system, not to punish individuals at anything close to the scale reserved for corporate non-compliance.
For a Data Fiduciary, Section 15 is a limited shield, not a general excuse — it doesn't let an organisation dismiss a legitimate grievance by labelling it frivolous, and it doesn't override the exhaustion requirement in Section 13 or the correction and erasure duties in Section 12. Its practical use is narrow: it gives a Fiduciary and the Board a basis to push back specifically where a request is genuinely made in bad faith, such as a fabricated identity claim or a demonstrably false complaint filed to pressure a business outcome unrelated to any real data-protection concern.
Illustration: an individual files a complaint with a company falsely claiming her account data was mishandled, in an attempt to extract a refund unrelated to any actual privacy issue. If the company can show the complaint was knowingly false, that conduct falls within Section 15(d) — though the Fiduciary's own Section 8(10) obligation to run a genuine grievance mechanism, and its Section 13 duty to respond, still apply to every other, genuine complaint it receives.
Section 12(3) and Section 13 are the rights this section's duties most directly qualify — correction and erasure requests (e), and grievances and complaints (d). Section 33(1) and the Schedule fix the ₹10,000 penalty ceiling, deliberately scaled far below the crore-level penalties the Schedule sets for a Fiduciary's own Section 8, 9 and 10 breaches.
30 minutes to talk through your grievance-handling workflow — no obligation.
Book a Consultation