Privacy portal & requests · DPDP S. 11–14 · Rules 9 and 14

A privacy portal for your customers. A queue with deadlines for your team.

Customers sign in with a one-time code, see every consent they gave you, withdraw any of it, and raise a rights request without a call. Your team gets each request in one queue with a clock, reminders and a full log.

Book a demo→ What the law asks

6: request types, including grievance and nomination
90 days: legal maximum to resolve a grievance
0: passwords for customers to remember

Figure 1. The customer portal and the staff queue. Sample data.

What the law asks

What rights does the DPDP Act give your customers?

Sections 11 to 14 give four rights. Rule 14 says how you must make them usable. The person must use your grievance process before going to the Board.

Requirement	Source	What it means	How Promiz helps
Right to information	S. 11	A summary of the personal data you process and the processing, and who you shared it with.	Access requests in the queue with a deadline; your team prepares the reply.
Correction and erasure	S. 12	Correct, complete or update data, and erase it unless you must keep it for the purpose or by law.	Correction and erasure requests routed to your systems by webhook.
Grievance redressal	S. 13 · Rule 14(3)	Give a way to complain. Publish your response time, no longer than 90 days.	Grievance officer and response period set in Organization Settings; grievances routed to them.
Nomination	S. 14 · Rule 14(4)	The person can nominate someone to use their rights after death or incapacity.	Customers nominate in the portal; the nomination is recorded.
Publish how to use rights	Rule 14(1)	Publish on your site or app how to make a request and which identifiers you need.	A branded portal reached from your banner, emails or a saved link.
Publish a contact	Rule 9	Show the contact of your DPO or the person who answers data questions.	Grievance officer details shown to customers.

Sources: Digital Personal Data Protection Act, 2023, sections 11 to 14; DPDP Rules, 2025, Rules 9 and 14. These duties apply from May 2027.

In Promiz

How does a rights request move through Promiz?

Each request has a clock from the moment it arrives, and every step is logged.

Figure 2. From sign-in to a closed request.

Step 1 The customer signs in
With a one-time code sent to their email or mobile, whichever you enabled.
Step 2 They raise a request
Access, correction, erasure, withdrawal or grievance, or they add a nominee.
Step 3 The clock starts
Promiz acknowledges by email, sets the deadline and notifies your systems.
Step 4 Your team acts
Review, then fulfil with a note or reject with a reason. Every step is logged.
Step 5 The request closes
The customer gets an email. A "request closed" event goes to your systems.

Capabilities

What do the portal and the queue include?

Branded self-service portal

Your logo and colours. Customers reach it from the "Manage my consent" link, a confirmation email or a saved link.

Consent preferences

Every consent the customer gave you and what it covers. Change or withdraw it at once. Download the notice and a receipt.

Six request types

Access, correction, erasure, withdrawal, grievance and nomination.

Deadlines and reminders

30 days by default, your own grievance period, and a reminder before each request is due.

Status emails

An acknowledgement when a request arrives and an answer when it closes.

Masked identifiers

Identifiers are masked in lists and revealed only when needed. Each reveal is logged.

Live counters

The menu shows open requests and turns red when any is overdue.

Events to your systems

Request received, deadline nearing, deadline missed, request closed, grievance raised, erasure requested and correction requested.

Compare

Why not handle rights requests by email?

Task	Email, spreadsheets and a basic banner	Promiz
Know when a reply is due	Nobody tracks the date	Clock, reminder and overdue flag
Verify the person	Reply to any email address	One-time code to a registered email or mobile
Withdraw consent	Wait for a staff member	Customer withdraws in the portal at once
Prove what you did	Search old threads	Every step logged, with notes and reasons
Tell your systems	Forward the email	Webhooks for erasure and correction

FAQ

Privacy portal & requests: frequent questions

Not answered here? Ask us in a demo.

What rights do customers have under the DPDP Act?

Four rights: information about their personal data (section 11), correction and erasure (section 12), grievance redressal (section 13), and nomination (section 14).

How long do we have to resolve a grievance?

You must publish your response period, and it cannot be longer than 90 days under Rule 14. In Promiz, you set the grievance period in Organization Settings.

What is the default deadline for other requests in Promiz?

30 days, with a reminder before it is due. You can change it to match your policy.

How do customers sign in to the portal?

With a one-time code sent to their email or mobile. There is no password.

Can a customer nominate someone?

Yes. Customers add a nominee in the portal. Under section 14, the nominee can use their rights if they die or cannot act.

Raise a request and close it with us.

In 30 minutes we sign in to a portal, raise an erasure request, and follow it through the queue to closure.

Book a 30-minute demo→ We reply within 1 business day.

This page explains the law in plain words. It is not legal advice. Your legal team decides how the Act applies to you. Last reviewed 21 September 2026.