Employee data rights request: form, response letters and request log
A single format from the Employee Personal Data under the DPDP Act pack. ss.6(4), 8(7), 11 to 15 and 17, DPDP Act 2023 · Rules 9 and 14, DPDP Rules 2025 · rules 5(6) and 5(9), SPDI Rules 2011.
- 8 pages
- 208
- Word and PDF
- 30 October 2026
- 30 October 2026
What it covers
- 1Employee data rights request: form, response letters and request logss.6(4), 8(7), 11 to 15 and 17, DPDP Act 2023 · Rules 9 and 14, DPDP Rules 2025 · rules 5(6) and 5(9), SPDI Rules 2011
Not included
What you will still need outside this format:
- Data processing agreements with payroll, HR and verification vendors (Data processing agreement pack)
- The website and app privacy policy for customers and visitors
- A DPDP readiness assessment of the Company's systems and vendors
- Obligations of a Significant Data Fiduciary (Data Protection Officer, impact assessment, data audit) and Consent Manager registration
- Technical implementation of security safeguards, erasure and breach reporting to the Data Protection Board and CERT-In
- Advice on a particular grievance or a complaint before the Data Protection Board
Read the opening
The first part of the format, as it downloads. Blanks are highlighted.
Scope. The right of access (s.11) and the right to correction and erasure (s.12) apply under the Act to personal data processed on consent, including data given voluntarily under s.7(a). Most employment data is processed under the legitimate use in s.7(i) and falls outside those two rights, but the right of grievance redressal (s.13) is not so limited, and the Company's privacy notice extends this procedure to all the personal data it holds as a matter of policy. Answer every request through this format; where you rely on the statutory limit, say so in Part 6 rather than ignoring the request. Commencement. The rights in ss.11 to 14 and Rule 14 apply from 13.05.2027. Until then, rule 5(6) of the SPDI Rules 2011 lets a person review and correct the information given, and rule 5(9) requires grievances to be redressed within one month. Timelines. Rule 14(3) requires the Company to publish a period, not exceeding ninety days, for responding to grievances. This format works to thirty days for every request and grievance, which meets both regimes. Every reply carries the contact details of the person who answers questions on the Company's behalf (Rule 9).
Part 1 · Data rights request form
[Name of the Company] · To be submitted to the grievance officer at [E-mail address of the grievance officer] or through [HR portal path or link for data rights requests]