Your client can withdraw consent, which takes effect at once with nothing for you to answer, or ask for a copy, a correction or deletion, which you answer on the Rights page within 90 days.
Everything your client can do starts from one private page. A withdrawal acts at once. A copy, a correction or deletion is a request that waits for you. The law gives you 90 days to answer each one (DPDP Rules, Rule 14). Our guide explains how to build a rights-request process.
1The rights link. We create one for every consent your client gives and show it once, on their receipt. It opens the page where they act.
2Withdrawing consent. Your client confirms and what we hold for that consent is deleted at once. You are told in the app and in the daily summary.
3When a law applies. If the request named a law and a period, a withdrawal deletes nothing at once. The documents are deleted when the law's period ends, counted from the withdrawal.
4The Rights page. Every copy, correction and deletion request your client makes lands here, with its clock.
5The 90 days. The clock starts on the day your client asks. We remind you 30 days and 7 days before the due day.
6Answer the request: - A copy: export the data, send it yourself, then mark it done. - A correction: correct the details in the folder, then mark it done. - A deletion: erase now, keep under law, or decline.
7Declining is open to you on all three kinds, and the reason you give is the one your client reads.
8What your client sees. Their request shows Done or Declined when they next open the link.
Two pages cover what to do when your client reaches you another way. If they ask you directly to withdraw, see withdrawing on their behalf. If they have lost their link, see why you cannot share it and act from their folder.
For example
Amaltas Deshmukh & Co sends Anita Deshpande a request on 1 July 2027. She finishes it the same day and her receipt shows her rights link. On 1 September 2027 she opens it and asks for a copy. The request lands on the Rights page, due 30 November 2027, which is 90 days later. On 8 September 2027 an admin exports her data, sends it to her and chooses Mark done. Her link now shows "Done on" 8 September 2027. Had she chosen to withdraw on 1 September 2027 instead, and the request named no law, her documents would have been deleted that moment.