Rights Request Log Template

RIGHTS REQUEST LOG

Organization: [Organization Name]
Maintained By: [Grievance Officer / DPO]
Internal Response SLA: [Access - 30 days, Correction/Erasure - 30 days, Grievance - 90 days] (align with your published grievance policy)

1. PURPOSE

This log tracks every request a Data Principal makes to exercise a right under Chapter III of the DPDP Act, 2023 - access to information (Section 11), correction and erasure (Section 12), nomination (Section 14), and grievance redressal (Section 13) - from receipt to resolution.

2. INSTRUCTIONS

Log a request within one business day of receipt, regardless of channel (email, web form, letter). Verify the requester's identity before disclosing or acting on any data. A request cannot be closed without a documented response sent to the Data Principal.

3. LOG

Column headers: Request ID | Date Received | Requester Name | Request Type (Access/Correction/Erasure/Nomination/Grievance) | Channel | Identity Verified (Y/N, Date) | Description of Request | Action Taken | Response Sent (Date) | Status | Days Elapsed | Owner

Example Row 1:
Request ID: RR-2026-014
Date Received: [DD-MM-YYYY]
Requester Name: [Requester Name]
Request Type: Access (Section 11)
Channel: Grievance portal
Identity Verified: Y - [DD-MM-YYYY] via OTP on registered email
Description of Request: Summary of personal data held and categories of processing
Action Taken: Compiled data export covering account, transaction, and support history
Response Sent: [DD-MM-YYYY]
Status: Closed
Days Elapsed: [18]
Owner: [Grievance Officer Name]

Example Row 2:
Request ID: RR-2026-015
Date Received: [DD-MM-YYYY]
Requester Name: [Requester Name]
Request Type: Erasure (Section 12)
Channel: Email to grievance address
Identity Verified: Y - [DD-MM-YYYY]
Description of Request: Requested deletion of account and all associated personal data
Action Taken: Confirmed no ongoing legal or contractual retention requirement; account and data queued for erasure per Section 8(7)
Response Sent: [DD-MM-YYYY]
Status: Closed
Days Elapsed: [12]
Owner: [Data Engineering Lead]

Example Row 3:
Request ID: RR-2026-016
Date Received: [DD-MM-YYYY]
Requester Name: [Requester Name]
Request Type: Grievance (Section 13)
Channel: Written letter
Identity Verified: Y - [DD-MM-YYYY]
Description of Request: Complaint that correction request from [DD-MM-YYYY] was not actioned
Action Taken: Investigated, corrected the record, escalated internal process gap to DPO
Response Sent: [DD-MM-YYYY]
Status: Closed - escalation available to Data Protection Board if unresolved
Days Elapsed: [21]
Owner: [Grievance Officer Name]

4. ESCALATION NOTE

Under Section 13, a Data Principal must first exhaust this internal grievance mechanism before approaching the Data Protection Board. Ensure every rejected or partially actioned request includes a clear reason and reference to this right, so the log can serve as evidence of good-faith redressal if the matter is escalated.

5. QUARTERLY SUMMARY

Total Requests Received: [_]
Closed Within SLA: [_]
Overdue: [_]
Escalated to Board: [_]
Common Themes / Process Fixes Identified: [_]