Section 15

Section 15 is one of the DPDP Act's most distinctive provisions globally: it imposes duties on Data Principals, not just rights. Most data protection frameworks — GDPR, UK GDPR, Australia's Privacy Act — are entirely oriented toward data subject rights and data controller obligations. The DPDP Act's framing of Data Principals as rights-holders who also bear responsibilities reflects a broader Indian constitutional philosophy: the Supreme Court in Puttaswamy itself emphasised that the right to privacy comes with 'a corresponding responsibility'. Four duties are specified: (a) not to make false or frivolous complaints — a provision designed to prevent abuse of the grievance system by flooding Data Fiduciaries and the Board with bad-faith complaints; (b) not to impersonate another when providing personal data — this targets identity fraud at the point of data collection, not just the use of data; (c) not to suppress material information when providing data for identity documents or proofs — critically important for KYC-dependent services like banking, insurance, and financial products; (d) not to furnish false information or impersonate in Board proceedings — protecting the integrity of the regulatory process. The penalty for breach is modest — up to Rs 10,000 — the lowest penalty in the Act's penalty schedule. This reflects that the primary purpose is deterrence and balance (countering the narrative that the Act is entirely Data Principal-friendly) rather than aggressive enforcement against individuals. The DPDP Act's symmetry — rights for Data Principals, obligations for Data Fiduciaries, duties for Data Principals — is politically significant: it helped secure passage of the Act by addressing industry concerns about abuse of the rights framework.