Section 15 of Digital Personal Data Protection Act, 2023 - Duties of Data Principal

Section 15 of the Digital Personal Data Protection Act, 2023 (DPDP Act) sets out duties that a Data Principal must observe while providing personal data and while exercising rights under the Act.

Commencement status as on 24 September 2026: Section 15 has been enacted but is not yet in force. Under the Central Government notification dated 13 November 2025, sections 11 to 17, including section 15, come into force eighteen months from publication of that notification, that is, on 13 May 2027.

Meaning of Data Principal

Under section 2(j) of the DPDP Act, a "Data Principal" is the individual to whom the personal data relates. Where that individual is a child, the expression includes the parent or lawful guardian. Where the individual is a person with disability, it includes the lawful guardian acting on her behalf.

Section 15 - Duties of Data Principal

The provision requires a Data Principal to observe five duties. In substance, the Data Principal must act lawfully and honestly while providing personal data or exercising statutory rights.

Section 15 provides that a Data Principal shall:

comply with all applicable laws for the time being in force while exercising rights under the DPDP Act;
not impersonate another person while providing personal data for a specified purpose;
not suppress material information while providing personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
not register a false or frivolous grievance or complaint with a Data Fiduciary or the Data Protection Board of India; and
furnish only information that is verifiably authentic while exercising the right to correction or erasure under the Act or the rules.

What each duty means

1. Compliance with applicable law

A Data Principal cannot rely on rights under the DPDP Act as a basis for violating another applicable law. Requests for access, correction, erasure, grievance redressal or other statutory rights must therefore be exercised consistently with the legal requirements applicable to the transaction or activity.

2. No impersonation

A person must not pretend to be another individual while supplying personal data for a specified purpose. The Act defines "specified purpose" as the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the Act and the rules.

3. No suppression of material information

When personal data is supplied for a document, unique identifier, proof of identity or proof of address issued by the State or its instrumentalities, the Data Principal must not suppress material information. This duty is directed at maintaining the integrity of identity and official-document processes.

4. No false or frivolous grievance or complaint

A grievance or complaint made to a Data Fiduciary or the Data Protection Board of India must not be false or frivolous. This duty should be read with section 13, which provides a right to grievance redressal and requires the Data Principal to exhaust the available grievance-redressal opportunity before approaching the Board.

5. Authentic information for correction or erasure

When exercising the right to correction or erasure under section 12, the Data Principal must furnish only information that is verifiably authentic. Section 12 deals with correction, completion, updating and erasure of personal data, subject to the conditions stated in that provision.

Penalty for breach of Section 15

The Schedule to the DPDP Act provides that breach in observance of the duties under section 15 may attract a monetary penalty extending to Rs. 10,000. Under section 33, a monetary penalty is imposed by the Board after an inquiry where the Board determines that a breach is significant and after giving the person concerned an opportunity of being heard.

Important: The duties of a Data Principal do not remove the independent statutory responsibility of a Data Fiduciary. Section 8(1) expressly provides that a Data Fiduciary remains responsible for compliance in respect of processing undertaken by it or on its behalf, irrespective of a Data Principal's failure to carry out duties under the Act.

Digital Personal Data Protection Rules, 2025

The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. Their commencement is phased. Rules 3, 5 to 16, 22 and 23 are scheduled to commence eighteen months after publication, while specified institutional and procedural rules commenced earlier. The Rules should therefore be read together with the statutory commencement notification when determining which obligations are currently operative.

Quick summary

Point	Section 15 position
Who must comply?	Data Principal
Main requirement	Act lawfully and honestly when providing personal data and exercising DPDP rights
False complaints	False or frivolous grievances or complaints are prohibited
Correction or erasure	Information furnished must be verifiably authentic
Maximum scheduled penalty	May extend to Rs. 10,000
Current status on 24 September 2026	Enacted but not yet in force; scheduled commencement is 13 May 2027

Official resources

For the authoritative text and current implementation material, refer to the official Digital Personal Data Protection Act, 2023, the official DPDP Rules, 2025 page, and the MeitY Acts and Policies portal.

This article is a general legal information resource. For a particular dispute, compliance question or proceeding, the Act, applicable Rules, commencement notifications and subsequent amendments or notifications should be checked as on the relevant date.