Privacy requests (DPDP)

Log data requests, find everything you hold about a person, download it, erase it, set retention rules and see opt-outs under India's DPDP Act.

India's Digital Personal Data Protection Act (DPDP) lets people ask a business what personal data it holds about them, have it corrected or erased, and expects the business to stop keeping data it no longer needs. Settings → Privacy (DPDP) gives you the tools to do that: a register of requests with due dates, a search for one person across the workspace, a download of what you hold, erasure, retention rules and a view of opt-outs.

Before you start: You need the Privacy (DPDP) permission at Can handle requests on the Roles page. Without it the page says "You need the Privacy permission to use these tools." Even with it, you only find, export and erase what your role can already open — give the person handling requests read and delete access to the record types that hold customer data.

Note: If you don't see this yet, the owner applies the waiting workspace upgrade — see Upgrade your workspace.

Open Settings (workspace name menu → Organization settings) and click Privacy (DPDP) in the left rail. The page has five tabs.

Requests

A register of every request, so none is missed.

  1. Click Log a request.
  2. Choose the Kind of request: Access (what do you hold?), Correction, Erasure, Grievance or Nomination.
  3. Enter the Person, their Email and/or Phone, and Received on.
  4. Reply due by defaults to 30 days after it was received. Change it if you need to.
  5. Pick who it is Handled by, add Notes, and click Log request.

Open a request to change its Status (Open, In progress, Done or Rejected — rejecting needs Why it was rejected). What was done lists the downloads and erasures made for it.

Find a person

  1. Enter an Email and/or Phone, optionally pick the request under For request (optional), and click Search.
  2. AxisIQ searches every record type, form response and sent message you can open. Emails match in any case; phone numbers match on their last 10 digits, so 98200 12345 finds +91 98200 12345.
  3. Results are grouped under Records, Form responses and Messages sent to them. Open takes you to a record.

Answer an access request: click Download everything (access request). You get one file with exactly what was found. The download is recorded on the request and in the audit log.

Erase: tick the records and form responses to remove. Tick Also stop all future messages to this email/phone to add them to Messaging's stop list. Click Erase selected, then Erase for good.

Important: Erased records skip the trash and cannot be restored. Issued invoices and other documents the law makes you keep are left in place and listed as kept.

Retention

Keep personal data only as long as you need it. For Form responses (all forms) and each of your own record types, set Keep for (days) (at least 30) and click Save. Clear the box and click Keep forever to switch a rule off.

Once a day, records not changed for that many days move to the trash — you have 30 more days to restore them — and form responses older than the limit are deleted. Invoices, payments and accounts are kept for your books and cannot be given a rule here.

Everyone who unsubscribed, opted out, bounced or complained, with Address, Channel, Why and When. Messaging never sends to these addresses. See Suppressions and unsubscribe.

Your obligations

A plain-language summary of what the Act expects: tell people why you collect their data, use it only for that, answer requests, erase it when done, keep it safe and report breaches. It is not legal advice — check your duties with your own adviser.