Grants individuals robust rights over their data. These include the right to access information about what data a fiduciary has about them, right to correction of inaccurate or misleading data, right to deletion/erasure of personal data that is no longer necessary (particularly when consent is withdrawn), and the right to grievance redressal (to complain and be heard by the organization, and escalate to the Board if unsatisfied). Individuals also have the right to be informed through clear notices at the time of data collection, including information on what data is collected and for what purpose. A unique provision allows data principals to nominate someone to exercise their rights on their behalf in case of death or incapacity. Additionally, data principals can withdraw consent at any point, and data fiduciaries must honor such withdrawal (stop processing and delete the data unless retention is required by law). These rights empower users to control their personal information and impose corresponding duties on organizations to respond to requests in a timely and compliant manner.