DPDPA Section 14: Right to Nominate a Representative on Death or Incapacity

The modern internet is a graveyard of locked accounts. When a user dies or loses cognitive function, their data usually sits frozen behind platform policies that refuse access to grieving families. DPDPA Section 14 changes that.

It establishes a simple but powerful mechanism: the right to nominate a representative. This is not just a legal footnote. It creates a lawful path for a trusted person to act when the original user no longer can. Rule 13 of the DPDP Rules is intended to prescribe exactly how this works, but the operational reality for businesses starts now.

What the law actually says

Under the Act, a Data Principal can nominate another individual to exercise their rights if they die or become incapacitated. Incapacity is not a vague feeling,it means the inability to exercise rights due to unsoundness of mind or infirmity of body.

In short, the nominee steps into the Data Principal’s shoes. They inherit the rights of access, correction, erasure, consent withdrawal, and grievance escalation.

Scope and eligibility

Who gets to make this call? An individual Data Principal. The text refers to individuals, not companies, and presupposes the legal capacity of an adult of sound mind.

Who can they name? Any other individual. A family member, a lawyer, a friend. But this is a fiduciary role, not a casual favor. The nominee must be capable of understanding and exercising data rights.

The law uses the singular. You get one nominee. If you want someone else later, you update the record.

When the nomination activates (and what proof is needed)

A nomination on paper is just theory until a trigger event activates it. There are two:

• Death. Proof will typically include a death certificate and verification of the nomination.
• Incapacity. Proof requires a medical certificate showing unsoundness of mind or infirmity of body, specialist evaluations, or a court order.

Data Fiduciaries cannot just take someone’s word for it. They must verify identity and authority before acting on nominee requests. Expect to see nomination evidence paired with hard proof of the triggering event.

What the nominee can and cannot do

A nominee has the power to manage the past, but they cannot authorize the future.

Authorized actions:

• Exercise all Data Principal rights under the Act (request access, seek correction, request erasure, withdraw consent, file grievances, escalate to the Data Protection Board).
• Request closure of accounts or termination of services where these follow from rights under the Act.
• Obtain copies or access where required to settle legal, tax, or estate matters.

Limitations:

• No new consents. A nominee manages existing relationships. They cannot authorize new processing on behalf of the incapacitated person.
• No personal exploitation. The nominee must not sell or commercially exploit personal data for their own benefit.
• No unlawful destruction. Rights operate subject to other laws. Requests that obstruct lawful investigations will not prevail.
• No cascading nomination. The nominee cannot name their own successor.

The standard is fiduciary: act in the Data Principal’s best interests, maintain confidentiality, and exercise good faith and respect for their known wishes.

Incapacity in practice

The statute defines incapacity as unsoundness of mind or infirmity of body that prevents exercising rights. The functional test is whether the person understands the nature and consequences of exercising rights and can communicate rational decisions about data.

• Likely incapacity: Coma, persistent vegetative state, advanced dementia, court-declared unsoundness of mind, severe stroke affecting cognition, or severe mental illness that removes decision-making capacity.
• Not incapacity by itself: Temporary hospitalization, temporary intoxication, old age without cognitive impairment, physical disability without cognitive impairment, or family disagreements.

What changes in practice for organizations

You can write a policy about dpdp data nominee rules, but if your engineering team hasn’t built a way to route a dead person’s rights to a living nominee, you are not compliant. Data Fiduciaries must design for verified delegation and maintain audit-ready records.

Key operational controls:

• Intake and record-keeping: Secure storage of nomination records, with the ability to record revocations and apply the latest valid nomination once Rule 13 procedures are specified.
• Identity and authority verification: KYC-equivalent checks on the nominee, validation of medical or death certificates, and consistent criteria for edge cases.
• Request handling: Standard workflows for access, erasure, and grievance escalation by nominees, complete with clear timelines and logging of every data disclosure.
• Conflict management: A process for pausing non-urgent actions during competing claims while verifying higher-quality evidence or court directions.
• Lawful basis checks: Screening erasure requests for conflicts with legal holds or statutory retention.
• Communications: Updating privacy notices and support scripts to explain exactly what documents a nominee needs to provide.

The engineering checklist:

• Data model fields to store nominee identity, scope, effective date, and revocation status.
• Authorization logic to route rights requests to the nominee after trigger validation.
• Evidence management for documents and validation metadata.
• Immutable audit trails bound to accounts, requests, and disclosures.
• Admin tooling for support teams to verify, approve, and monitor nominee-driven requests.

Practical guidance for individuals

Understanding how to nominate data representative dpdp requires more than just picking a name.

• Choose wisely. Trust, integrity, availability, and basic technical competence matter.
• Prepare a concise nomination. Include names, dates of birth, addresses, identifiers, signatures, and a clear statement authorizing the nominee to exercise your rights on death or incapacity.
• Keep records. Store the original securely, give a copy to the nominee, and keep a digital copy your family can locate.
• Submit to Data Fiduciaries. Until a central mechanism exists under Rule 13, provide the nomination to each relevant Data Fiduciary and keep the acknowledgments.
• Update when life changes. Replace the nomination if the nominee becomes unsuitable.

Minors and already incapacitated persons

Section 14 assumes the nominator can exercise rights when making the nomination. Practically, this points to adults with capacity. Minors typically act through a parent or lawful guardian for data rights. A person who is already incapacitated cannot nominate; in those cases, rely on guardianship or court directions.

Interpretation boundaries

Section 14 covers the transfer of rights under the DPDPA. It does not convert personal data into property for all purposes, and it does not replace financial asset nominations. Platform account control remains subject to separate contract terms, but Data Fiduciaries must honor rights under the Act when a valid nominee acts. The nominee’s authority is strictly bounded by the Act, the rules, and other applicable laws.

Closing

Section 14 gives individuals control over what happens to their data when they cannot act. For organizations, it requires disciplined processes to accept a nominee’s authority, verify evidence, and apply rights correctly while honoring other legal duties.

Getting this wrong risks harm to families and exposure during audits. Getting it right is a function of clear procedures, staff training, and robust systems. Regodit helps teams structure these exact workflows, keep the evidence straight, and prove compliance without the drama.