Section 15 — DPDP Act, 2023
Every Data Principal shall— (a) comply with the provisions of all applicable laws while exercising rights under the provisions of this Act; (b) not impersonate another person while providing personal data for any specified purpose; (c) not suppress any material information while applying for any document, unique identifier, proof of identity or proof of address; (d) not register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; (e) furnish only such information as is verifiably authentic, while exercising the right under section 12.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 15 is unusual in data protection law — it places duties on the individual whose data is being protected, not just on the organisations processing it. These duties exist to prevent the rights regime from being weaponised: impersonation, false grievances, and providing fraudulent information while exercising rights are all prohibited. The practical implication for Data Fiduciaries is that a Section 15 duty violation by a Data Principal does not automatically excuse the Data Fiduciary from its own obligations — but it may be relevant to a Board adjudication if the Data Fiduciary acted in good faith on information later found to be false.
A Data Principal files 50 access requests in a month across different accounts to test a platform's response time, with no genuine data access need. This is a frivolous use of Section 11. While the platform must still respond in good faith, the Data Principal's conduct may constitute a Section 15(d) violation that the Board can take into account.
A person files an erasure request claiming to be another individual whose data they want removed. This violates Section 15(b). The Data Fiduciary's identity verification requirement (under Rule 14) is the first defence — but Section 15(b) means the impersonator is also in violation of the Act.