Skip to content
VITI Security
Contact

DPDP Act 2023

DPDP Data Principal Request Estimator

Estimate the monthly workload and cost of handling DPDP data principal (DSR) requests.

The rights a Data Principal has

RightDPDP Act
Information about what is processed and who it is shared withs.11
Correction, completion, updating and erasures.12
Grievance redressal by you, before going to the Boards.13
Nominating someone to act for them after death or incapacitys.14

Deadlines and what you must publish

  • Publish, on your website or app, how people can exercise their rights and what details you need to identify them (Rule 14).
  • Publish your grievance response period, which must not exceed 90 days, and meet it (Rule 14(3)).
  • Publish the business contact details of the person who answers questions about your processing: your DPO, if you are a Significant Data Fiduciary (Rule 9).

People must use your grievance process before they can complain to the Data Protection Board (s.13(3)), so a slow or ignored queue turns into a regulatory problem. Data Principals have duties too: a false or frivolous complaint can attract a penalty of up to ₹10,000 (s.15).

Sizing the work

The estimator above multiplies requests a month by minutes per request and your loaded hourly cost. What usually drives the minutes is not the request but the search: if customer data sits in five systems with no common identifier, every request means five manual searches. Mapping where data lives, and giving each person one identifier across systems, is what makes requests cheap.

When it applies

These rights become enforceable on 13 May 2027, with most of the DPDP Rules. Read the DPDP Act and Rules 2025 guide.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. Monthly hours = requests per month x minutes per request / 60.
  2. Monthly cost = monthly hours x your fully loaded hourly cost; annual cost = monthly cost x 12.
  3. Colour by workload: 160 or more hours a month (roughly one full-time person) is red, 40 or more amber, less than 40 green.
  4. The intake channels you select only add a note; they do not change the cost.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Colour thresholds (hours a month)
Amber from 40, red from 160

Worked example

The calculator run on its default inputs:

Expected requests per month
50 requests
Average handling time per request
45 minutes
Fully-loaded hourly cost of the handler
₹800
Intake channels you must monitor
Email

Estimated DSR handling load

₹3.6 Lakh/yr

Monthly effort
37h 30m (37.5 hrs)
Monthly cost
₹30,000
Annualized cost
₹3.6 Lakh
Intake channels
email

With the defaults (50 requests a month, 45 minutes each, ₹800 an hour, email only): 50 x 45 / 60 = 37.5 hours a month, x ₹800 = ₹30,000 a month, or ₹3.6 lakh a year. That is under 40 hours, so it shows green.

Sources

Sources last checked September 2026.

Limitations

The figure is handling time only - not tooling, legal review or the effort of searching systems that are hard to query. Data Principals must use your grievance process before going to the Board (s.13(3)), so a slow queue becomes a regulatory problem. The rights take effect on 13 May 2027. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.