A Client Asks What Data You Hold: Handling a DPDP Right to Access Request
A DPDP right to access request often arrives as one short email. The client asks what personal data you hold on them, and gives no reason. Often nobody on the team knows where that client's papers sit.
Under section 11 of the DPDP Act, 2023, a Data Principal can ask for a summary of the personal data processed about them, the processing activities, and the firms and processors it is shared with. The firm checks who is asking, gathers the data, and replies in plain language. For the wider picture, read the DPDP guide for CA firms.
The days below are a working plan for your team. They are not a legal period. The rights provisions apply from about 13 May 2027, unless the government shortens the period.
Day 0: log the request
Write down the date it arrived, the sender's name, the contact details and the exact question. Give the request a reference number. The log is the first thing anyone will ask for, if the matter ever goes further.
Days 1 to 2: confirm who is asking
The firm may verify the requester's identity before it acts. Match the request to a client already on file, using details the firm holds. Don't open a single folder until this step is done.
- The request and its log entry
- The client's details already on record
- No new ID documents, unless the match fails
Avoid asking for new ID you do not need. Each extra copy is one more file to protect.
Days 3 to 5: find the data
Search the client's folder, the file index, and the staff inboxes and chats where that client's papers may sit. Check old files too. Personal data on paper counts once it is scanned or entered into a system. Paper that was never digitised sits outside the Act.
The firm stays responsible for personal data in its possession or control. That includes data held by its staff and processors, whatever device they use (section 8(1) of the Act). A staff member's personal phone is therefore part of the search.
The notice given at intake should already list the data the firm holds, which makes the search shorter. The consent notice sample shows the layout.
Reply in plain words, then keep the record
Give the summary, the processing activities and the recipients, in plain language. Name the person who answers questions, and give one contact. The Rules also require the firm to publish the contact of the person who answers questions (Rule 9). Use that same contact in the reply. Then keep the request, the verification note, the reply and the access log together.
How long do you have to reply?
The DPDP Rules, 2025 do not fix a number of days for replying to an access request. Rule 14(3) does cap the reply to a grievance at a reasonable period not exceeding 90 days. A client who is not satisfied must use the firm's grievance process before going to the Data Protection Board. So treat the request as urgent, and reply as soon as the data is found.
If the request shows a leak or an erasure
A request can also show that files went where they should not. If it does, follow the breach steps for a client file. If the client then asks for deletion, the right to erasure guide covers what can be deleted. Statutory records, such as GST and income-tax records, stay.
Keep each client's data in one folder
Searching several phones and inboxes is the slowest part of this request. Reposha, DPDP-ready document management, gives each Client a folder, so the search starts in one place. Only staff with access to that Client can open the files. Clients upload from a phone or laptop, with no account, in English or Hindi.
Reposha's access log is the record of who looked at what. Every open and download is logged, which helps when the question is who saw the file.
Start at reposha.com.
Questions people ask
What must a firm give a client who asks for their data?
A summary of the personal data it holds, the processing done on it, and the firms and processors it is shared with. The firm may verify the requester's identity before it replies.
How long does a firm have to answer an access request?
The DPDP Rules, 2025 set no fixed day count for an access request itself. Rule 14(3) caps the reply to a grievance at 90 days, so answer as soon as the data is found and record the date the request arrived. The rights provisions apply from about 13 May 2027, unless the government shortens the period.
How can a firm gather a client's data quickly for an access request?
Keep each client's papers in one folder, then search that folder instead of phones and inboxes. Reposha, DPDP-ready document management, gives each Client a folder and logs every open and download.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
