What Data Principal duties mean without using them to deter requests

A privacy help page should help people exercise their rights. Opening it with a warning about fines can do the opposite, particularly if the warning suggests that any unsuccessful complaint or mistaken detail will attract a penalty. The DPDP Act contains duties for individuals, but those duties need careful explanation.

Section 15 addresses compliance with applicable laws when exercising rights, impersonation, specified suppression of material information, false or frivolous complaints, and authenticity of correction or erasure information. As of 22 October 2026, section 15 and the main penalty provisions are scheduled for May 2027 under the commencement notification.

Describe the duties in their actual scope

The impersonation duty concerns pretending to be another person when providing personal data for a specified purpose. The material-information duty is framed around providing data for documents, identifiers and identity or address proofs issued by the State or its instrumentalities. It should not be paraphrased as an unlimited duty to tell every business everything it asks.

The complaint duty concerns false or frivolous grievances or complaints. A customer who disagrees with a refusal, misunderstands an invoice or asks a difficult question is not automatically making a false or frivolous complaint. The organisation needs facts and fair handling, not a label that makes an awkward ticket disappear.

The authenticity duty supports reliable correction and erasure processes. Explain what information the business needs and why. If a customer supplies an incomplete request, help them resolve the gap rather than immediately treating it as misconduct.

Duties do not cancel fiduciary responsibility

Section 8(1) makes the fiduciary responsible for compliance despite a Data Principal’s failure to carry out duties. That is an important boundary. A business cannot use a customer’s mistake as a general excuse for weak security or unrelated unlawful processing.

Imagine a hypothetical subscription service where a customer mistypes their email address. The service should investigate the error and any resulting disclosure. It should not assume that the typo removes all responsibility for its own verification, access or correction processes.

The facts may still matter to the investigation. A deliberate attempt to impersonate someone is different from an ordinary input error. Record the evidence and escalate serious concerns through the appropriate process rather than making an unsupported accusation in a customer reply.

Keep penalty explanations proportionate

The Act’s Schedule provides a maximum of ₹10,000 for breach of section 15 duties. That is not an automatic charge a business can levy whenever it dislikes a request. Penalties under section 33 follow the Board’s inquiry and decision process, with the statutory requirements and opportunity to be heard.

Section 28(12) also provides for a warning or costs where the Board considers a complaint false or frivolous. Do not collapse these provisions into a promise that every rejected complaint will be fined. Nor should a support agent imply they personally decide a statutory penalty.

If a website explains duties, place them in accessible guidance alongside rights and process information. Use neutral wording about truthful details and avoiding impersonation. A prominent threat banner can misrepresent the framework and discourage legitimate contact.

A better frontline response

Suppose a customer requests correction of a delivery address but supplies conflicting information. A helpful response identifies the conflict and explains what would allow the team to verify the change. It avoids disclosing unnecessary account details and gives a route for customers who cannot use the usual verification channel.

If the team suspects impersonation, it can pause a risky disclosure or change while escalating the concern. The internal record should distinguish suspicion from a confirmed finding. Staff should not declare fraud merely because the person cannot remember an old order number.

Where requests are repetitive, check whether the earlier response actually answered the question. Repetition may indicate unresolved confusion, a broken channel or an inaccessible explanation. It is not conclusive evidence of bad faith.

Train for fairness as well as accuracy

Use hypothetical examples of an honest typo, an unsupported change request and a clear impersonation attempt. Ask staff what evidence they would seek and which actions they would pause. This helps them apply the distinction without turning every customer into a suspect.

Review templates for overbroad language such as “false information voids all your rights”. Replace it with a precise explanation of the required information and next step. The request process should remain usable for people who are uncertain, distressed or unfamiliar with legal terms.

Individual duties support trustworthy interaction. They work best when explained as bounded responsibilities within a fair process, while the organisation continues to meet its own independent obligations.