Data Principal Rights
Automate the rights a Data Principal is owed — access, correction, erasure, nomination and grievance — end to end, with signed proof.
What it does
Rights requests are where compliance stops being a policy document and becomes an operational problem. Each one has a clock, needs identity verification, has to reach every system holding that person's data, and must leave evidence that it was done.
dpflo runs the whole request: intake through a branded portal, identity verification, a cross-source search driven by the identity graph from Discovery, then fulfilment with an audit trail. Correction writes back to source systems rather than producing a to-do list for someone else.
Erasure is deliberately harder than one click. Four-eyes approval is required, and completion produces a signed certificate naming the systems the data was removed from — because an erasure you cannot evidence is one you may have to perform again.
Capabilities
Cross-source DSAR search
Uses the identity graph to resolve a request to every copy of that person's data, not just the system the request arrived through.
s.14 nomination
Lets a Data Principal nominate someone to exercise their rights on death or incapacity — a DPDP-specific duty with no GDPR equivalent.
Correction with write-back
Pushes the correction into source systems and records confirmation, rather than raising a ticket and hoping.
Four-eyes erasure with signed certificates
Two-approver workflow, then a tamper-evident certificate listing every system the record was erased from.
Grievance redressal with SLA tracking
The statutory grievance channel, with timers, escalation and a complete history per complaint.
Which duties this discharges
The obligations under the DPDP Act 2023 that this module is built to satisfy. The Act takes full effect on 13 May 2027.
- s.11Right to access information about personal data
- s.12Right to correction, completion, updating and erasure
- s.13Right to grievance redressal
- s.14Right of nomination
Section references are to the Digital Personal Data Protection Act, 2023 and are provided for orientation, not as legal advice.
Works with
Consent Lifecycle Management
Capture, prove and honour consent across every channel — with a ledger that stands up when a regulator asks what someone actually agreed to.
Read moreData Discovery & Classification
Find every piece of personal data you hold — across databases, cloud storage, SaaS apps and APIs — before you try to govern it.
Read moreGovernance, Records & Audit
The obligations that prove you are compliant — records, assessments, retention and audit integrity — kept current instead of rebuilt before each audit.
Read moreSee Data Principal Rights on your own data
A 30-minute walkthrough against the systems you actually run — not a generic demo environment.