Data Subject Rights
All 5 rights are exposed as form surfaces. The consuming app must wire the endpoint before production.
Under DPDP §14, data principals in India have enforceable rights against a data fiduciary. This starter exposes each as a form. Submissions POST to /api/dsr; wire that endpoint in the consuming app so acknowledgements and fulfilment follow your stated SLA.
Right to Access
Receive a summary of all your data we hold, why we process it, and who else has received it.
SLA: 7 days
Right to Correction
Correct inaccurate or incomplete personal data we hold about you.
SLA: 14 days
Right to Erasure
Withdraw consent and erase your data, subject to statutory retention obligations.
SLA: 30 days
Right to Grievance
Raise a complaint about how your data was handled. Routes to our named Grievance Officer.
SLA: 7 days ack · 30 days resolution
Right to Nominate
Nominate another person to exercise your rights in the event of death or incapacity.
SLA: 14 days
What happens after you submit
- You receive an acknowledgement email with a ticket reference within minutes.
- If we need additional verification (e.g. to confirm you own the email), we ask within 24 hours.
- We respond substantively within the SLA shown for that right.
- If you're unsatisfied, escalate to the DPO or Grievance Officer.
What we cannot honour
- Requests where we cannot verify you are the data principal (we will not act on a stranger's request)
- Erasure where statutory retention applies (e.g. tax records, court-ordered preservation)
- Access to data we do not hold (we cannot manufacture data on demand)