Chapter III · Rights and Duties of Data Principal
Section 14: Right to nominate
Section 14 lets a person nominate someone to exercise their DPDP rights if they die or become incapacitated, without handing over account ownership, inheritance or general control.
- Chapter
- Chapter III · Rights and Duties of Data Principal
- Status
- Enacted · phased commencement
- Full compliance
- 13 May 2027
- Applies to
- Data Principals & Data Fiduciaries
- Official citation
- DPDP Act, 2023, s.14
- Reading time
- 6 min
- Updated
- August 2026
At a glance
Section 14 lets a Data Principal nominate, in the prescribed manner, any other individual to exercise her rights under the Act if she dies or becomes incapacitated [14(1)]. "Incapacity" is defined narrowly as an inability to exercise those rights due to unsoundness of mind or infirmity of body [14(2)]. The DPDP Rules, 2025 allow one or more individuals to be nominated in line with the Data Fiduciary's terms of service. The nominee may exercise data-protection rights only, such as access, correction, erasure, consent withdrawal and grievance, and does not gain account ownership, passwords or inheritance rights. It is scheduled to take effect on 13 May 2027.
Key takeaways
- A person can nominate any other individual to exercise their DPDP rights on death or incapacity [14(1)].
- Incapacity is narrow: unsoundness of mind or infirmity of body [14(2)], not simply being away, inactive or unreachable.
- The DPDP Rules, 2025 allow one or more nominees under your terms of service, so define priority, revocation and conflicts in advance.
- A nominee exercises DPDP rights only (access, correction, erasure, withdrawal, grievance), not passwords, account ownership or inheritance.
- Verify three things: a valid, unrevoked nomination, the trigger event, and that the requested action is a permitted right.
- This is a high fraud and social-engineering risk, so add strong verification and a cooling-off step for irreversible deletions.
Who should read this
Read this if you hold accounts or personal data for individuals, because Section 14 forces a safe, verifiable process for handling requests after a customer dies or loses capacity.
In plain language
Section 14 is about continuity of privacy rights, not digital inheritance. A nominee can step in to exercise the person's DPDP rights if they die or lose capacity, but they do not inherit the account, the content, the passwords or the estate.
The trigger is narrow. "Incapacity" means an inability to exercise rights due to unsoundness of mind or infirmity of body, so you should not activate nominee authority just because someone is travelling, inactive or slow to reply.
Because the Rules let a person name one or more nominees, you need to decide the rules in advance: can they act alone or jointly, who has priority, how is a nominee replaced or revoked, and what happens if two nominees give conflicting instructions.
The text of the law
Section 14: Right to nominate
14(1) A Data Principal has the right to nominate, in the prescribed manner, any other individual who shall, in the event of her death or incapacity, exercise her rights under the Act and Rules.
14(2) "Incapacity" means the inability to exercise the rights of the Data Principal due to unsoundness of mind or infirmity of body.
Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Capture nominations through an authenticated channel (account settings or a verified workflow), and record enough to identify and contact the nominee, no more.
- Support the full lifecycle: view, update, replace and revoke a nominee, with confirmation to the Data Principal.
- On a nominee request, verify a valid unrevoked nomination, evidence of death or incapacity proportionate to the risk, and that the action is a permitted right.
- Process each request through the matching workflow, access, correction or erasure, consent withdrawal or grievance, rather than granting blanket account access.
- A nominee erasure request carries the same Section 12 limits: delete unless a specified purpose or a law requires retention, and protect any third-party data.
- Add fraud safeguards and conflict rules for multiple nominees, and update your notice, terms and deceased-user procedure. Not sure yours is ready? Take the readiness assessment.
Frequently asked questions
What does the right to nominate do?
What counts as incapacity under Section 14?
Can I nominate more than one person?
Does a nominee get my account or inherit my data?
When does Section 14 take effect?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.