Handle Rights Requests Without a Compliance Team

DPDPA grants four core rights: Right of Access (S.11) — know what data is held and how it is used; Right to Correction/Erasure (S.12) — correct inaccurate data or request deletion; Right to Grievance Redressal (S.13) — escalate unresolved complaints; Right of Nomination (S.14) — nominate someone to exercise rights on death or incapacity. All five request types (including Grievance) are available in the DPDPA Shield portal.

DPDPA requires Data Fiduciaries to respond within 30 days. DPDPA Shield enforces this with a live countdown on every request, amber alerts at Day 20 and Day 25, and a red critical alert at Day 28. If a response is not initiated by Day 29, the DPO is auto-notified by email. The SLA timer is always visible to your entire compliance team.

Each submission triggers a 6-digit OTP sent to the email address provided. The OTP expires in 10 minutes and allows 3 attempts. Only after successful OTP verification is the request accepted and forwarded to your DPO. This prevents fraudulent erasure requests and provides a verifiable identity trail for your audit records.

A closure PDF is an auto-generated document created when a request is resolved. It includes the original submission, identity verification record, every status change, all communications sent, and the final closure reason — timestamped and stored immutably in Cloudflare R2. If challenged by a regulator, this document is your complete evidence of compliance.