The rights of the people you serve
Access, correction, erasure, grievances and nomination
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Four rights you must support
People have four rights. Your systems must let them use each one, within the timelines you publish.
The access right covers data processed on the basis of consent (or the 'voluntarily provided' legitimate use). It includes the identities of other fiduciaries and processors you shared the data with. Erasure can be refused where retention is needed for the purpose or by law.
Handling a rights request
Rule 14 says publish how people can use their rights, including any identifier you need, like a customer ID or username.
Keep identity checks proportionate. Asking for more data than you already hold, just to verify, can itself be a problem. Log every request, the response and the date, so you can show the Board you met your timeline.
90 days maximum to resolve a grievance
The final Rules added a hard cap. Grievances must be resolved within a reasonable time, never more than 90 days.
The January 2025 draft had no timeline. 90 days is an outer limit, not a target. Shorter, published timelines reduce the number of complaints that escalate to the Board.
Where a complaint can go
People must use your grievance process first. Only after that can they complain to the Board. Appeals go to the Appellate Tribunal, then the Supreme Court.
A strong internal grievance process is your best defence: it resolves most issues early and creates a record. The Board can also direct parties to mediation (s.31). Appeals against Board orders go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days.
People have duties too
Data Principals also have duties. Breaking them can lead to a penalty of up to ₹10,000.
The Board can also order costs against a complainant who files a frivolous complaint. This protects businesses from abuse, but it does not let you ignore requests you find annoying.
In one line
Next: the extra duties for big players, and the rules on sending data abroad.