1. Executive Summary: The Right to Know

Section 11 is the "transparency cornerstone" of the DPDPA. It gives Data Principals the fundamental right to ask: "What do you know about me?"

This isn't just paperwork - it's informational self-determination in action.

1.1 The Three Pillars of Access Rights

1.2 Critical Limitation: Consent-Based Only

Key Text: "The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent..."

This means:

• ✓ Section 11 applies when you CONSENTED to processing
• ✗ Section 11 does NOT apply to Section 7 processing (legitimate uses without consent) - EXCEPT Section 7(a)

2. Philosophical Foundations: Transparency & Accountability

2.1 John Stuart Mill: Information as Liberty

Mill, On Liberty (1859): "If all mankind minus one, were of one opinion, and only one person were of the contrary opinion, mankind would be no more justified in silencing that one person, than he, if he had the power, would be justified in silencing mankind."

Data Protection Application: Information asymmetry = silencing. When organizations know everything about you but you know nothing about what they know, you're effectively silenced in the data relationship.

Section 11 restores voice by giving Data Principals the right to demand transparency.

2.2 Louis Brandeis: Sunlight as Disinfectant

Justice Louis Brandeis (1914): "Sunlight is said to be the best of disinfectants; electric light the most efficient policeman."

Section 11 Implementation:

• Sunlight = Transparency: Data Fiduciaries must disclose what they're doing
• Disinfectant = Accountability: Knowing they must disclose deters bad practices
• Policeman = Enforcement: Access requests enable Data Principals to detect violations

2.3 Amartya Sen: Development as Freedom

Sen, Development as Freedom (1999): Argued that freedom requires capability - not just absence of constraints, but positive ability to act.

Data Protection Parallel:

• Negative Right: "Don't process my data without consent" (Section 4)
• Positive Right: "Show me what you're doing with my data" (Section 11)

Section 11 provides the capability to exercise control - not just the abstract right.

2.4 Academic Research on Access Rights

Key Studies:

Urban et al. (2020) - "The Unwanted Sharing Economy: An Analysis of Cookie Syncing and User Transparency" ACM CCS.

Found that even technically sophisticated users couldn't understand what companies knew about them without explicit disclosure requirements.

Harkous et al. (2018) - "PriBots: Conversational Privacy with Chatbots" SOUPS.

Demonstrated that conversational, accessible privacy information (like Section 11 summaries) dramatically increased user understanding.

Sanchez Chamorro et al. (2020) - "Do Cookie Banners Respect my Choice?" IEEE S&P.

Found that without access rights, users couldn't verify whether their choices were actually being respected.

Section 11 implements these findings: Access enables verification, verification enables trust.

3. Constitutional Framework: Right to Information

3.1 Puttaswamy: Informational Autonomy

Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

3.2 Article 21: Know Thyself (Digitally)

Supreme Court has held that Article 21 (right to life) includes right to know about oneself.

Mr. X v. Hospital Z, (1998) 8 SCC 296: Court held patient has right to medical information about themselves.

Extension to Digital Context: If you have right to know your medical data, you certainly have right to know your digital data.

3.3 Right to Information Act, 2005 - Parallel Principle

RTI Act gives citizens right to information from public authorities. Section 11 extends this principle to private sector data processing.

Common Philosophy:

• RTI: "The state serves the people; people have right to know what state does"
• Section 11: "Data Fiduciaries hold data in trust; Data Principals have right to know what Fiduciaries do"

4. Scope of Section 11: Who Can Request?

4.1 "The Data Principal"

Who qualifies?

• ✓ You (individual whose data is being processed)
• ✓ Your parent (if you're under 18)
• ✓ Your guardian (if you have disability affecting capacity)
• ✓ Your nominee (after your death, for limited purposes)
• ✗ NOT random third parties
• ✗ NOT competitors seeking company information

4.2 "To Whom She Has Previously Given Consent"

This is a critical limitation. You can only request access from Data Fiduciaries to whom you:

1. Gave explicit consent under Section 6, OR
2. Provided deemed consent under Section 7(a) (employment context)

Cannot request from:

• Data Fiduciaries processing under Section 7(b)-(j) (legitimate uses)
• Data Fiduciaries you never interacted with
• Data brokers who obtained your data from others (unless you originally consented to that sharing)

5. Section 11(1)(a): Summary of Personal Data & Processing Activities

Statutory Language: "a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data"

This subsection has TWO components:

5.1 Component 1: Summary of Personal Data

What must be disclosed:

5.2 Component 2: Processing Activities

"...and the processing activities undertaken by that Data Fiduciary..."

This means: "What are you DOING with my data?"

5.3 What is NOT Required: Raw Data Dump

Section 11(1)(a) requires a "summary" - not a complete raw database export.

6. Section 11(1)(b): Data Sharing Disclosure

Statutory Language: "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared"

This is the "Who knows about me?" disclosure.

6.1 Two Required Elements

1. IDENTITIES: Names of all entities data was shared with
2. DESCRIPTION: What specific data was shared with each entity

6.2 Data Processors vs. Data Fiduciaries: Why Distinction Matters

7. Section 11(1)(c): Other Prescribed Information

Statutory Language: "any other information related to the personal data of such Data Principal and its processing, as may be prescribed"

This is a future-proofing provision - allows government to add disclosure requirements via Rules as technology evolves.

7.1 Currently Prescribed Information (Rule 13)

DPDP Rules 2025, Rule 13 prescribes additional disclosures:

• Data Retention Period: How long each category of data will be kept
• Cross-Border Transfers: Countries where data is transferred (if applicable)
• Automated Decision-Making: If algorithms are used for decisions affecting the Data Principal
• Data Protection Officer Contact: (For SDFs) How to contact DPO
• Grievance Officer Contact: How to file complaints
• Data Breach History: Whether Data Principal's data was involved in any breaches (if yes, details)

7.2 Potential Future Prescribed Information

As technology evolves, government may prescribe disclosure of:

• AI training usage (was your data used to train AI models?)
• Biometric processing details
• Genetic data processing
• IoT device data collection specifics
• Brain-computer interface data (neurotechnology)
• Metaverse/VR behavioral data

8. Section 11(2): Law Enforcement Exception

Statutory Language: "Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences."

This is the "national security and law enforcement" exception.

8.1 What This Means

Normal Situation:

• You request access under Section 11(1)(b)
• Data Fiduciary must disclose WHO they shared your data with

Exception under 11(2):

• If Data Fiduciary shared your data with law enforcement (police, CBI, NIA, etc.) for investigation/prosecution
• They do NOT have to disclose this sharing

8.2 Strict Requirements for Exception

Exception applies ONLY if ALL conditions met:

1. Authorized by Law: Receiving entity must be legally empowered to get data (police, courts, regulators with legal authority)
2. Written Request: Request must be in writing (not verbal)
3. Specified Purposes: ONLY for:
   • Prevention of offences/cyber incidents
   • Detection of offences/cyber incidents
   • Investigation of offences/cyber incidents
   • Prosecution of offences
   • Punishment of offences
4. Actual Law Enforcement Context: Not just any government request

8.3 Exception Limited to 11(1)(b) and (c) Only

Important: Section 11(2) exception applies ONLY to subsections (b) and (c).

This means:

• ✓ Can hide that data was shared with law enforcement (11(1)(b) exception)
• ✓ Can withhold other prescribed info related to investigation (11(1)(c) exception)
• ✗ CANNOT hide what personal data exists or processing activities (11(1)(a) still applies)

Practical Effect: Even under investigation, you can still see WHAT data the Fiduciary has and WHAT they're doing with it. You just can't see that police have a copy.

9. The Access Request Process (Rule 13)

9.1 How to Make a Section 11 Request

Rule 13 prescribes the manner of making requests:

9.2 Frequency of Requests

Rule 13 Limitation:

• First request in 12 months: FREE
• Subsequent requests in same 12 months: Data Fiduciary may charge reasonable fee

Rationale: Prevents abuse (repeated frivolous requests), but ensures everyone gets at least one free access per year.

"Reasonable fee": Cost-recovery only, not profit-making. Typically ₹100-500 depending on complexity.

10. Data Fiduciary Response Obligations

10.1 What Data Fiduciary MUST Do

10.2 What Data Fiduciary CANNOT Do

11. Comparative Analysis: DPDPA vs GDPR vs CCPA

Key Difference: DPDPA's Section 11 applies ONLY to consent-based processing (narrower than GDPR/CCPA). However, for consent-based processing, protection is comprehensive.

12. Practical Compliance Guidance

12.1 Section 11 Compliance Checklist for Data Fiduciaries

12.2 Common Section 11 Violations

12.3 Sample Access Request Template (For Data Principals)

13. Conclusion: Knowledge as Power

Section 11 is more than a legal right - it's a power shift.

For decades, organizations held all the cards: they knew everything about us, we knew nothing about what they knew. This information asymmetry created a power imbalance that enabled exploitation.

Section 11 rebalances the scales.

Key Principles to Remember:

1. Consent = Access Right: If you consented, you can access
2. Three Components: (a) Data summary & processing, (b) Sharing disclosure, (c) Other prescribed info
3. Plain Language Requirement: Summaries must be understandable, not technical dumps
4. 30-Day Response: Data Fiduciaries must respond within 30 days (extendable to 60)
5. First Request Free: No charge for first annual access request
6. Law Enforcement Exception: Sharing with police/investigators need not be disclosed (11(2))
7. Enables Other Rights: Access information enables correction (Sec 12), erasure (Sec 13)

Section 11 is the foundation of informational self-determination - you cannot control what you do not know about.