Short Answer
You must provide a clear, non-technical summary of all personal data being processed and its purpose.
You must provide a clear summary of personal data being processed, along with the purpose and how it is used. This should be understandable, not technical.
This requires businesses to maintain a centralized data view, otherwise responding becomes operationally difficult.
Law Reference
Section 11 – Right to Access Information
Without a centralized data view across systems, responding to access requests becomes operationally impossible and risks regulatory action.
A customer of a fashion brand requests their data. The brand must provide a summary showing name, email, purchase history, loyalty points, and marketing preferences from their CRM.
Was this answer helpful?
Our team is here to help you with any questions about DPDP compliance.