#Data Principal Rights Request Form

FRM-GL-505 | Version 1.0.0 | Last Modified On 03 August 2026

---

Estimated completion time: about 5 minutes. Most of the fields are optional, and you never have to attach an identity document to begin. Submitting this form starts your statutory clock: you receive a reference number and an acknowledgement within 3 Business Days.

#Before you start: are you in the right place?

Most people who reach this page are looking for their hospital, not for Pensieve. Read these three lines first. The right one may save you the form.

If you only want the email address and website data this Trust Center holds about you removed: the fastest route is the self-serve tool at https://trust.pensievelabs.org/privacy/your-data. It needs no account. You enter your address, follow a link sent to it, and your identifiers are removed or pseudonymised across the site. That page also lists, in full, everything this site stores about you.

Everyone else uses the form below. If you are a website or Trust Center visitor, a prospective customer, a Trust Center credential holder, a subscriber, a supplier, a job applicant, or a member of hospital staff who holds a Pensieve credential, then over that data Edsol Edtech Pvt. Ltd. is the Data Fiduciary in its own right, and this form is how you exercise your rights against it.

#The rights you can exercise, and the law behind each

You do not need to know the law to use this form. This table is here so you can see what you are entitled to before you ask for it.

#The form

#Section 1. About you and how to reach you

#Section 2. Your relationship, jurisdiction and identifier

#Section 3. Whose request this is

#Section 4. What you are asking for

#Section 5. Verifying it is you, and your declaration

How Pensieve verifies you, proportionately. Pensieve verifies enough to be confident you are who you say you are, and no more. If you give an identifier it already holds (field 8), it confirms by sending a link to the email on that record, as the self-serve erasure tool does. It does not ask a known or logged-in person for a government identity document. It asks for an additional check only where the request would disclose a body of personal data, or where you are acting for someone else. Any identity data you give is used only to verify this request, never for anything else, and is deleted when the request closes. This follows the DPDP Rules (Rule 14(1)(b) and 14(5)), which point to the identifier you already have, and regulator guidance on proportionate verification.

#After you submit: what happens, and by when

Step by step.

1. You submit. Pensieve records the request with a reference number and a timestamp, and sends you that reference.
2. Within 3 Business Days Pensieve acknowledges, using the Data Principal Request Notice (NTC-GL-019), and repeats the business contact for questions about the processing, which Rule 9 of the DPDP Rules requires in every response. That contact is the Grievance Officer named in POL-GL-066.
3. Pensieve verifies your identity proportionately, as above, asking once and saying why if it needs anything.
4. Where the record belongs to a hospital, Pensieve does not decide the request. It refers you to the hospital and, within 3 Business Days, tells the hospital so its own clock is not lost (POL-GL-066 Section 5; DPA-GL-001).
5. Pensieve responds in writing within the timeline above, with the decision, the reasoning and what it will do. For an erasure, what is kept because the law requires it is set out in DIS-GL-023.
6. If you are not satisfied, you may appeal, as below.

No fee. There is no charge to make a request, in any market. The Digital Personal Data Protection Act and its Rules prescribe none. Under the GDPR (Article 12(5)) a request that is manifestly unfounded or excessive, in particular a repeated one, may attract a reasonable fee or be refused. Pensieve carries the burden of showing that, and will give its reasons and the appeal route rather than a bare refusal. In Australia there is no charge to make a request, though a not-excessive charge for giving access may apply (APP 12).

Appeal and escalation. Tell Pensieve within 30 days and the decision is reviewed by someone who was not involved in it. You may also go straight to the external route. Pensieve does not require you to exhaust its process first. The Grievance Officer (POL-GL-066) is the internal appeal. After that, the external authority is the Data Protection Board of India, or, for a GDPR request, your supervisory authority, which in the United Kingdom is the Information Commissioner's Office, or, in Australia, the Office of the Australian Information Commissioner. POL-GL-066 Section 6 lists these by market.

#A note on timing

Pensieve operates this form to the full Digital Personal Data Protection framework now, and none of the commitments above is conditional on a commencement date. For completeness: the operational Rule on rights handling (Rule 14) commences on or about 14 May 2027, while the one-month Grievance Officer duty under Rule 5(9) of the SPDI Rules, 2011 is in force today, and Pensieve applies the shorter period where both could apply. [UNVERIFIED: one-day discrepancy in the Rules' publication date, 13 or 14 November 2025, which shifts the derived commencement dates by one day. Pensieve treats the earlier date as the conservative one.]

#Related documents

#Change history

---

FRM-GL-505 v1.0.0 | Last Modified On 03 August 2026 | Review due 03 February 2027 | Published at https://trust.pensievelabs.org