What happens if we ignore a data principal request?
The Data Principal can escalate. Having used your grievance mechanism without a satisfactory response, they may complain to the Data Protection Board, which can inquire, direct remedial measures and impose financial penalties. Ignoring requests also removes your best mitigation, because the Board weighs whether the organisation acted responsibly.
Most organisations do not refuse requests deliberately; they lose them. A request arrives in an individual's inbox, that person is away, and the clock runs. A single monitored intake with SLA tracking removes most of the exposure.
Where you decline part of a request — erasure against a statutory retention duty, for instance — say so and say why. A reasoned refusal is a defensible position; silence is not.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →