Who Speaks When the Data Principal Cannot? The Right to Nominate under Section 14 of the DPDP Act, 2023 and Its Collision with Indian Capacity Law

Author

Jyotirmay Sharma, Sumit Gurjar

Abstract

 Section 14 of the Digital Personal Data Protection Act, 2023 lets a Data Principal nominate another person to exercise her statutory rights if she dies or becomes “incapacitated.” It is one of the shortest provisions in the Act and, so far, one of the least examined. This paper argues that its brevity conceals a structural problem. The Act defines incapacity as “unsoundness of mind or infirmity of body” but says nothing about who decides that the condition has arisen, and Rule 14(4) of the 2025 Rules then makes the nomination subject to the Data Fiduciary’s own terms of service. Indian law already contains at least three older routes by which one person may speak for another (the nominated representative under the Mental Healthcare Act, 2017, limited guardianship under the Rights of Persons with Disabilities Act, 2016, and succession to a deceased person’s estate), and none was drafted with the DPDP nominee in mind. Drawing on the scholarship on post-mortem privacy and on the American fiduciary-access statute, together with the French and Italian data protection codes, the paper proposes a four-part reconciliation test covering trigger verification, source of authority, scope, and revocability. It applies that test to a mental-health-app hypothetical and closes with targeted amendments to Rule 14 and a model nomination clause for fiduciaries.

Keywords

Data Protection, Right to Nominate, Section 14 DPDP Act, Post-Mortem Privacy, Mental Healthcare Act, Legal Capacity, Digital Succession.

Full Text:

Download Paper PDF

References

Section 14 is easy to admire and hard to apply. The idea that a person should be able to decide in advance who will speak for her is sound, and it has a respectable constitutional pedigree. But the provision names the nominee and then stops. It does not say how the trigger is established, how the nominee ranks against representatives appointed under other statutes, or how far the nominee may go. Rule 14(4) resolves these questions by deferring to the one party with the strongest commercial interest in an easy answer.

The four-part test proposed here (trigger verification, source of authority, scope, and revocability) is meant to give fiduciaries and the Data Protection Board a disciplined way to reason about those questions before litigation does it for them. Its recommendations are modest. They ask for evidence from outside the nominee’s own assertion, respect for earlier formal choices by the principal, sensible limits on what may be read or destroyed, and recognition that incapacity may pass.

The paper has limits. Section 14 is not yet in force, so there is no fiduciary practice to observe and no Board decision to analyse. The foreign law is described from secondary materials and the statutes themselves, and should be checked against current text before anyone relies on the comparison. The practitioner commentary cited is, by nature, not peer-reviewed. The analysis also confines itself to adult principals and leaves aside the position of children, whose data is governed by a separate regime, and the State exemptions in the Act.

A last question will come soon enough. Once services can build conversational replicas from a person’s messages, the nominee will be asked not only to close or read an account but to authorise a digital version of the dead to go on speaking. The principal’s own choice, made earlier and in writing, is the best answer available. The law should be ready to honour it.

Share your valuable work from Social Media Buttons