Chapter 12 — Rights, Grievances, Identity and Nomination

1. From a matrix of owners to a machine that runs

Chapter 4 made the organisational argument: a right is not satisfied by a policy but by a named, funded, evidenced service, and it delivered the rights-to-service ownership matrix — right, service, Responsible, Accountable, identity assurance, SLA. That chapter answered who. This chapter answers how: the case lifecycle that turns the matrix into a machine an operator can actually run — intake, identity assurance, validation, execution, evidence, response, escalation — with the failure modes of each stage named, because a rights service fails at its stages, not in principle.

The reason the how deserves its own chapter is that rights services are where the programme’s abstractions meet the programme’s public. The inventory, the purpose matrix, the consent chains, the processor contracts — all of them exist so that a real person, arriving with a real request on an ordinary Tuesday, can be answered correctly and within a deadline. The Section 13(3) exhaustion screen (Chapter 4’s tension) makes the grievance service the enterprise’s front door to the regulator; the nomination right makes the rights machinery handle the worst day of a principal’s family’s life. This is the operating chapter for all of it.

Sections 11 and 12 cover access and correction/completion/updating/erasure for the statutory prior-consent scope, expressly including Section 7(a). Search all relevant systems within that eligible processing scope, not automatically every record about the person under any ground (ACT:441–476).[1] Section 13 provides grievance redressal and exhaustion of that opportunity before approaching the Board; Section 14 provides nomination on death or statutory incapacity (ACT:477–495).[1]

Section 15 sets duties, not a fifth right or a criminal identity-verification code. Its clauses cover applicable-law compliance while exercising rights, nonimpersonation, nonsuppression of material particulars for State-issued documents/identifiers, no false/frivolous grievance, and verifiably authentic information for correction/erasure. The old attribution of false particulars to Section 15(a) was wrong (ACT:496–509).[1] Proportionate authentication principally protects the person’s confidentiality and integrity; a duty placed on a principal does not excuse a fiduciary’s unsafe disclosure.

The idea. A rights request is a case, and a case is a lifecycle with gates: each stage — intake, identity, validation, execution, evidence, response, escalation — has a defined pass condition and a recorded decision, and the case record that results is simultaneously the principal’s answer and the enterprise’s audit defence. The lifecycle is not bureaucracy layered on a simple task; it is what makes a high-volume, deadline-bound, exception-prone service run the same way twice.

2. The tension: rigour at the gates versus the principal’s experience

The lifecycle’s stages exist to protect both sides — the principal’s data from the wrong requester, the enterprise from the wrong execution — and every stage adds friction. The tension this chapter holds is between the rigour the gates require and the experience the principal receives, and it is felt most sharply in identity assurance.

The rigour pull. Weak authentication can disclose a person’s summary to an attacker or permit destructive changes. Preserve what was verified, the evidence scope and unresolved doubt. Do not describe Section 15(b) as a criminal impersonation offence created for this workflow; its exact duty wording and the applicable enforcement framework are distinct (ACT:496–509).[1]

The experience pull. But every additional document demand, every verification round-trip, is friction placed in front of a principal exercising a statutory right — and the friction has a compliance cost of its own: a rights service that quietly discourages requests by being exhausting is failing “readily available” (Section 13(1)) in spirit even if it answers what arrives. Worse, the over-collection instinct — demanding an Aadhaar scan to answer a request the account’s own authentication could settle — can exceed justified verification needs; where consent is the basis, Section 6(1)‘s necessary-data limitation applies (ACT:206–215).[1] The recommendation is to use the least additional evidence sufficient for the actual threat, not to assume every identity document request is automatically unlawful.

The failure modes:

• Under-assure. The self-service reset path answers rights requests on weak authentication; the case record cannot say who was actually verified; an impersonator walks away with a data summary.
• Over-friction. The demand-a-document instinct, uncalibrated: every request triggers maximum verification, requests stall, principals abandon, and the service’s statistics look excellent precisely because it has failed the population it exists to serve.
• Inconsistent-assure. The enterprise uses different assurance levels for the same action on different channels — weak authentication on the mobile app, heavy document demands on the web form, no verification on the email channel — producing a system where the principal’s experience depends on how she arrives, not on what she needs.

The recommended reconciliation is graded assurance, with an explicit threat and action scope. An existing authenticated session may support a low-risk request; sensitive disclosure, changed contact destinations and representative activation need additional checks. This is an author-designed control model, not a statutory proof-document list. A verification failure restricts disclosure or mutation while keeping receipt, assistance and grievance routing available.

3. The case lifecycle, stage by stage

Intake. The request arrives — web form, in-app, the grievance channel, a letter, a Consent Manager-mediated message (Chapter 11) — and the first discipline is classification: which right (or rights) is being invoked, and is the request actually a rights request at all (the support ticket that is really an erasure demand; the grievance that embeds an access request). Mis-classified intake is how requests die in the wrong queue, so classification is a recorded decision, not a form field. Chapter 4’s point about “readily available” lives here: intake exists where principals actually are, and the Consent Manager channel (Chapter 11) is an intake surface too. The intake classification must handle compound requests — a principal who asks for “all my data and please delete the marketing consent” has invoked Section 11 and Section 12 and Section 6(4) in one sentence — and the case must track each right’s lifecycle independently even as the identity and validation stages apply to the whole.

Identity assurance. Keep the person whose data is requested separate from the acting individual and her authority. The following completed operating matrix is Q03 guidance, not a prescribed authentication standard.

Scope and legal validation. For each work item, join subject, prior consent, purpose and exemption/limitation. Section 11(1)(a) calls for a summary of processed data and activities; (b) calls for other fiduciary/processor identities and descriptions of shared data. Section 11(2)‘s qualifying written law-authorised request for offence/cyber-incident purposes limits (b)/(c), not (a) or all disclosure indiscriminately (ACT:441–462).[1]

Correction/completion/updating are Section 12(2); Section 8(3)‘s accuracy duty separately applies where data is likely to be used to make a decision affecting the principal or be disclosed to another fiduciary. Downstream correction and a hold on a pending decision using stale facts are recommended implementations of those duties, not text found in the processor-erasure clause Section 8(7)(b) (ACT:338–359,463–476).[1]

Section 12(3) provides the specified-purpose/law retention exception; it does not literally prescribe a reasoned-refusal format. This playbook recommends an explained partial response with exact scope, authority and follow-up. Section 17 exemptions require their own conditions and retained duties; counsel decides real mixed-ground scope rather than a blanket all-record or no-record outcome.

Execution. The machinery runs: the access summary assembled from the inventory (the Section 11(1)(b) sharing description drawn from the processor map), the correction propagated, the erasure run through Chapter 14’s deletion plane with its receipts and its Section 8(7)(b) propagation, the grievance’s underlying fault actually fixed. Execution is where the rights service’s dependence on the earlier chapters becomes literal: an access answer is only as complete as the inventory; an erasure only as real as the deletion plane’s reach; a correction only as thorough as the processor map’s coverage. The execution stage must also handle partial execution: an erasure that succeeds in four stores and fails in the fifth (a processor’s API is down) must be recorded as partial, the principal informed, and the retry scheduled — not silently completed and hoped for.

Evidence. The case record closes its loop: requester, assurance result, validation decisions, executed actions, deletion receipts, propagation acknowledgements, response text, timestamps throughout. Chapter 4’s rule holds — the evidence belongs to the enterprise, not the tooling — and lands in the Chapter 22 grid. The evidence stage is not a separate step; it is the recording discipline that runs through every previous stage. Each gate’s decision is recorded when it is made, not reconstructed later. Each execution action is timestamped and receipted when it happens. The case record is built in flight, not assembled after the fact — because after the fact, the reconstruction is always incomplete, and the Board’s inquiry will show the gaps.

Response. Use the timing matrix below. A numeric internal target is not a statutory access/erasure deadline. Distinguish answer sent, action completed, action pending and restricted retention, then provide the processing contact required by Rule 9 (RULES:1168–1172).[3] If a processor is pending, a response can be issued, but the case must not be labelled fully executed.

Escalation. The defined exits: internal (the exception authority, counsel at the decision gates) and external (the principal to the Board after Section 13(3) exhaustion; the Appellate Tribunal path beyond). The service’s escalation log is its own defence exhibit — the record that grievances were answered before the regulator saw them. Escalation is not failure; it is the defined path for cases that exceed the service’s authority — the Section 17 exemption that needs counsel’s sign-off, the erasure that conflicts with a statutory retention obligation, the nomination activation that requires legal verification. The escalation path must be documented in the service’s procedure, and the case record must show when escalation was considered and why it was or was not invoked.

4. The grievance service as the front door

Chapter 4 established the strategic stakes; the operational notes belong here. The grievance queue is where rights failures, consent failures, withdrawal failures, and product defects can surface — a grievance service is one detection instrument for control defects, not necessarily the earliest in every case (the synthetic CASE-001 timeout illustrates one such route). Triage classifies not only what the grievance asks but the underlying control defect: each grievance is tagged to the control plane whose failure it alleges, and the tag feeds the Chapter 24 dashboard. A grievance service run purely as ticket-churn — resolve, close, forget — wastes an important source of control-defect evidence.

Rule 14(1)/(2) requires prominent publication of request means and identifying particulars and supplies the prior-consent request mechanism. Rule 14(3) supplies the published reasonable grievance-response period not exceeding ninety days, with technical/organisational effectiveness measures. It does not prescribe a universal ninety-day or seventy-two-hour response for access, correction or erasure (RULES:1294–1318).[3] Section 13(2) counts from receipt, not later internal classification (ACT:483–485).[1]

These internal targets are hypothetical service choices, not replacements for reasonable-time duties, applicable sector requirements or prompt risk reduction. This pack does not use a published grievance window to delay urgent cessation. Rule 14(2)‘s wording and Sections 11/12 prior-consent framing must be read together; disputed mixed-ground application remains QL-010. An employment-only Section 7(i) fixture is not automatically an Section 11/12 entitlement, while its independently scoped grievance remains routable.

Where both the Company and a CM receive a grievance, each tracks its own receipt and applicable duty. A shared coordinator may reconcile answers but cannot record “someone answered somewhere” as both recipients’ compliance. Section 13(3) requires exhaustion of the grievance opportunity before Board approach; it does not let the enterprise define unlimited internal appeals or a mandatory wait after a substantive rejection. Provide the currently verified external route and preserve the person’s correspondence (ACT:477–487).[1]

5. Nomination: the service nobody wants to test

The nomination right deserves its own operational treatment, because it is the rights service’s hardest case and the one every enterprise hopes never to exercise. Two distinct services, separated by years:

Intake. Section 14 permits another individual to exercise the principal’s rights on death or incapacity; incapacity means inability to exercise those rights due to unsoundness of mind or infirmity of body. Rule 14(4) permits one or more individuals using the fiduciary’s terms, applicable law, means and required particulars (ACT:489–495; RULES:1312–1318).[1][3] The Seventh Schedule is instead the governmental-purpose/authorised-person schedule linked to Rules 23(1)/8(3); it defines neither nominees nor nomination rights (RULES:1894–1921).[3]

Activation. Nomination is not a subject rename. Retain subject_id, actor_id, authority_id, authority_type, nomination version, scope, event evidence, verification result, activated/revoked times and reviewer. A nominee’s authority to exercise SUB-001’s rights does not give her unrestricted access to all the Company’s data or independent authority for new marketing. A valid nomination alone is insufficient before the triggering event.

Separate guardian route. Section 2(j) defines the individual to whom data relates and, for children, includes parents or lawful guardian, and for a person with disability includes the lawful guardian acting on her behalf. It does not delete the child’s or represented person’s identity (ACT:73–79).[1] Parent, lawful guardian, ordinary helper and Section 14 nominee have different routes and evidence. The child’s data remains keyed to the child; representative scope changes without corrupting that lineage.

In the synthetic specimen, NOM-001 and NOM-002 name SUB-006 and SUB-007 for SUB-001 at EVT-012. The associated Q03-AUTH-001/002 record nomination, not present unrestricted authority. At EVT-013, INCAP-001 is a stipulated substantiated activation event. Both nominees pass the authored identity/record checks, but one requests deletion and the other disputes it. DEC-008 pauses the conflicting action for Legal resolution. First arrival, spouse status or a larger document upload does not determine priority. Necessary protective restrictions and independently lawful retention continue; no nominee gets a blanket person-level overwrite.

At EVT-014, INCAP-002 stipulates recovery. Revoke the activated representative permissions and preserve nomination/history separately so future eligibility can be evaluated under then-valid terms. Requests under the revoked activation fail; SUB-001’s authenticated direct rights remain available. Death is not handled as reversible incapacity. Real evidence standards, conflicting nominees and applicable succession/capacity law require legal review; no invented statutory medical-certificate or probate checklist is prescribed.

The nomination record’s persistence requirement is non-obvious and severe. The nomination is recorded during the principal’s life; it is activated years later, after the principal’s death or incapacity, by a nominee who may not have been told the nomination was made. The record must survive platform migrations, schema changes, database upgrades, and the ordinary chaos of enterprise data management. It must be findable by the nominee who does not know the system’s internals. And it must be verifiable — the identity assurance gate at activation must be able to confirm that the record matches the event and the person, which means the record’s integrity must be demonstrable years after it was created.

6. Refusal paths as decisions, not dead ends

Every rights service must refuse some requests — Section 12(3) permits the fiduciary to retain data for compliance with other laws; Section 11(2) limits the specified sharing-information components on qualifying facts; Section 17 provides the exemption grounds. The discipline is to treat refusal as a decision with the same gate structure as a grant: named decision-maker, documented basis, scheduled future action, and a response that tells the principal what was refused, on what ground, and what happens next.

A reasoned erasure response should name the retained classes, actual authority, permitted uses, review owner and next eligibility event. The response case may be responded_partial with execution tasks still open; it cannot be marked complete while a processor remains pending. Once execution is reconciled and only a documented lawful-retention obligation remains, the service may close the response work while linking an independently owned disposal obligation. Keeping one customer ticket open for years is an optional operating choice, not text required by Section 12(3) (ACT:473–476).[1]

Do not promise an exact deletion date where a processing reset, lawful hold or other-law period is unresolved. Say what is known and when eligibility will be reviewed. Nor should a refusal under Section 11(2) or Section 17 disclose material whose disclosure is itself restricted. The recommended explanation is scoped to what may lawfully be communicated, with an internal exact-authority record retained for review.

7. The control-test-evidence set

8. Two worked walkthroughs

RIGHTS-001 — completed synthetic case and response specimen

The dossier fragment out/remediation/Q03/rights-case.json is a populated operating example with source and evidence-category fields. It is not real borrower data or a sent response. At EVT-009 (2 June 2027 12:00 +05:30), subject and actor are both SUB-001. Requested components are access, correction and erasure; WITHDRAW-001 already withdrew PUR-002. CONSENT-001 and CONSENT-002 establish prior consent for the relevant processing; a withdrawal does not erase that historical fact. Each statutory component receives its own scope decision.

The authored source inventory identifies application/contact records in SYS-002, the restricted marketing projection at SYS-003 and related authority/evidence material. Access content describes lending assessment/application handling and optional marketing before withdrawal, then cessation and restricted retention. It names ENT-003 as cloud host for hosted contact/application records and ENT-004 as marketing processor for contact channel, preference and adult-eligibility projection. ENT-002 insurance disclosure is not invented: PUR-010 has no completed sharing event in this scenario, so the answer does not list it as a recipient merely because a proposed flow exists. Historical sharing to a discovered unverified supplier would require investigation, not omission from the search record.

The contact correction changes a synthetic address-version label from Q03-CONTACT-v1 to Q03-CONTACT-v2 at the authoritative store. Its downstream propagation is a stipulated pending task where evidence is absent, not an observed all-systems pass. A pending consequential decision using v1 is restricted pending refresh under the recommended accuracy control. The erasure decision DEC-006 separates withdrawn marketing use from Rule 8(3) restricted retention; no unsupported eight-year financial period is asserted. HOLD-001 concerns only disputed DS-002 transactions and awaits its exact authority, not a blanket marketing exception.

To SUB-001 — illustrative response, not sent. Your access, correction and erasure request RIGHTS-001 was received on 2 June 2027 at 12:00 +05:30. We have prepared a summary of your contact/application information and its use for your requested application, plus the optional-marketing processing before you withdrew consent. In this example the sharing record identifies cloud host ENT-003 for hosted application/contact records and marketing processor ENT-004 for your contact channel, adult-eligibility flag and preference. Supplier copy verification remains incomplete and is recorded as a follow-up, not hidden from this answer.

Your contact-version correction is recorded at the source in this synthetic case. Downstream confirmation remains pending, and we have restricted the affected stale-data decision path pending refresh. Marketing consent CONSENT-002 was withdrawn at WITHDRAW-001. Local marketing access is denied; ENT-004’s cessation acknowledgement ACK-001 has not been received. We cannot confirm remote cessation or deletion everywhere.

DEC-006 records continued restricted retention of the covered personal data and processing logs under Rule 8(3)‘s one-year minimum for Seventh Schedule purposes, with security records separately assessed under Rule 6(1)(e). Retention is not permission to resume marketing. Application-purpose records under CONSENT-001 are assessed separately. The proposed disputed-transaction HOLD-001 applies only to DS-002 and still requires its exact legal-authority review; we do not rely on it as an established blanket reason to keep marketing data. EVT-025 is a disposal-eligibility review, not a guaranteed final erase date.

This case is responded-partial, with supplier and correction follow-ups assigned to Rights Operations and Supplier Manager. Contact Company Privacy Office at privacy@company.invalid / https://company.invalid/privacy/contact with processing questions. Use https://company.invalid/privacy/grievances for a grievance; the specimen service publishes 30 calendar days for grievance response. After exhausting that opportunity, verified Board complaint instructions must be provided at https://company.invalid/privacy/board-complaint before this template is used in production. These reserved endpoints are examples, not live contact channels.

The contact paragraph implements the Rule 9 response-contact requirement; the disclosed summary and sharing are mapped to Section 11, correction to Section 12(2), and qualified erasure to Section 12(3) with Section 8/Rule 8/Rule 6 interaction (ACT:338–359,441–476; RULES:1101–1106,1153–1172).[1][3] The narrative does not claim all requested actions completed merely because the response is readable.

DEC-008 — disputed nominees and later recovery

NOM-001/NOM-002 and INCAP-001 activate the separate representative review described above. The case record keeps SUB-001 as subject while requests identify SUB-006 or SUB-007 as actor. Conflicting instructions pause only the disputed action; Legal owns the authority decision and both actors receive a minimal status rather than each other’s unnecessary documents. INCAP-002 later ends the activated permissions; replaying an old representative request fails current authority even if its historical evidence was valid. This is a usable failed branch, not a successful spouse-to-subject re-key disguised as a walkthrough.

For the exercise, substitute an ordinary helper who knows SUB-001’s account ID but has no nomination or active subject instruction. Expected outcome: no disclosure or destructive execution; assistance and grievance intake remain available. Then restore a valid old nominee token after recovery. Historical validity must not bypass current revocation. These tests preserve the difference between identity, authority and the underlying person’s data.

9. What remains for the reader and the reviewer

The open items, each <residual>:

1. Determine actual mixed-ground and exemption facts, including QL-010; known Section 11/12 applicability and Rule 14’s grievance ceiling are incorporated above.
2. Verify real nomination/activation/recovery evidence and applicable terms/law without prescribing an invented universal proof list. Multiple-nominee priority is not supplied by an imaginary schedule.
3. Resolve actual retention resets, sector instruments and physical disposal/processor evidence; communicate remaining actions honestly.
4. Verify the live Board complaint route, translations and actual identity controls before production. Reserved endpoints and authored fixture checks are not a deployed rights service.

The question that hands the book its next chapter

This chapter supplies a case model and populated teaching record, not a completed production rights service. Chapter 13 extends the same subject/actor separation to children, parents and lawful guardians, whose protection cannot be reduced to waiting for a rights request.

Evidence and reusable artifacts

The primary-text line keys ACT, COMM, RULES and CORR resolve to the retained files below. Line numbers count physical newlines, not PDF form feeds. The canonical provision register supplies actor, trigger, conditions, exceptions and effective dates; chapter recommendations and synthetic examples are not statutory forms. The Q03 source manifest preserves URL, retained retrieval metadata and recalculated hashes.

• ACT: research/legal/evidence/01_dpdp_act_2023_gazette.txt
• COMM: research/legal/evidence/02_gsr_843e_commencement.txt
• RULES: research/legal/evidence/05_gsr_846e_dpdp_rules_2025.txt
• CORR: research/legal/evidence/06_gsr_892e_corrigendum.txt

Completed chapter fragments, before/after evidence and actual local checks: out/remediation/Q03/. Blank operating templates remain under research/operations/templates/; The reconciled integrated dossier is the reader working copy; these chapter fragments preserve the earlier bounded examples and their run evidence.

Blank companion: research/operations/templates/rights-workflow-template.md; completed Q03 fragments retain the same decision boundaries.

Sources

[1] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf — ACT [2] https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf — COMM [3] https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf — RULES [4] https://www.meity.gov.in/static/uploads/2025/12/3c7ebbae0e5456f493f486e6845df86b.pdf — CORR

Contents · Reader guide and citation conventions · Artifact index