The Rules of Nomination under DPDPA may require a correction

Section 14 of the DPDPA recognises the “Right to Nominate” as a right of the Data Principal.

The DPDP Rules, 2025 leave certain aspects of this right open to debate, as they appear legally unclear.

The section 14 of DPDPA 2023 states as follows:

Right to nominate.

(1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.

(2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.

The Rule 14(4) of the DPDPA Rules indicate the following:

(4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.

There are several issues in this Section that are debatable under law. Let us discuss them here.

These provisions of DPDPA need to be read along with ITA 2000, Section 1(4) which states as follows

“Nothing in this Act shall apply to documents or transactions specified in the First Schedule by way of addition or deletion of entries thereto”

The schedule I of the Act indicates the following as a document included under this section.

A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925 (39 of 1925) including any testamentary disposition whatever name called.

In view of the above, if the  nomination is in the “Electronic” form as a part of the privacy notice and consent, it would not be recognized as a legally valid document and hence whether it is digitally signed or supported by other means of authentication such as OTP it shall have no validity. Alternatively, the “Nomination” should be treated only as a “Transfer of Custody” of the asset and not like a testamatory document.

Nomination may however be obtained through a written form.

To understand the problem, we can explore the concept of Nomination in other laws particularly in the Banking where there are specific detailed instructions.

The Banking Regulation Act defines  “Nomination” as follows.

45ZA. Nomination for payment of depositors’ money.

(1)Where a deposit is held by a banking company to the credit of one or more persons, the depositor or, as the case may be, all the depositors together, may nominate, in the prescribed manner, one person (Ed: or upto 4 persons as per later amendment) to whom in the event of the death of the sole depositor or the death of all the depositors, the amount of deposit may be returned by the banking company.
(2)Notwithstanding anything contained in any other law for the time being in force or in any disposition, whether testamentary or otherwise, in respect of such deposit, where a nomination made in the prescribed manner purports to confer on any person the right to receive the amount of deposit from the banking company, the nominee shall, on the death of the sole depositor or, as the case may be, on the death of all the depositors, become entitled to all the rights of the sole depositor or, as the case may be, of the depositors, in relation to such deposit to the exclusion of all other persons, unless the nomination is varied or cancelled in the prescribed manner.

(3) Where the nominee is a minor, it shall be lawful for the depositor making the nomination to appoint in the prescribed manner any person to receive the amount of deposit in the event of his death during the minority of the nominee.

(4) Payment by a banking company in accordance with the provisions of this section shall constitute a full discharge to the banking company of its liability in respect of the deposit
Provided that nothing contained in this sub-section shall affect the right or claim which any person may have against the person to whom any payment is made under this section.

Further, the Section 39 of the Insurance Act 1938 defines “Nomination by the Policy Holder” linking it to the event of the death of the policy holder. Rule 19 of the Companies (Share Capital and Debentures) Rules 2014 prescribes the procedure under the Companies Act.

Section 72 of the Companies Act states nomination in the context of shares as ” any person to whom his securities shall vest in the event of his death.”.

All the above regulations apply Nomination only in case of death and not in case of “Incapacity”. Also, in cases where the data principal is mentally incapacitated ab initio, the legal guardian is also called the “Data Principal” by definition. Hence the concept of nominee stepping into the shoes to exercise the rights of the now incapacitated data principal appears to contradict with the need for appointment of a legal guardian.

Further it is established that settlement of dues from a Bank to a nominee follows the “Trustee “Principle”.

The Trustee principle has been endorsed by the Supreme Court of India (in landmark judgments like Smt. Ram Chander Talwar v. Devender Kumar Talwar and Sarbati Devi v. Usha Devi)established that a nominee is merely a custodian or trustee. The Shakti Yezdani v. Jayanand Salgaonkar (SC, 2023) also upholds the same principle.

It is also clarified that the nominee has the legal right to receive the money from the bank, but they do not automatically inherit it. They are legally obligated to hand over those funds to the rightful legal heirs (as designated by a Will or by intestate succession laws)

The primary purpose of Section 45ZA(4) is to protect the banking institution.

  • Once the bank verifies the account holder’s death certificate and the nominee’s identity, it transfers the money to the nominee.
  • This payment gives the bank a full and valid discharge of its liability. It frees the bank from getting caught in bitter family disputes or waiting for time-consuming court orders like a Succession Certificate
  • Up to Four Nominees: Following updates implemented under the Banking Laws (Amendment) Act, 2025, depositors can nominate up to four individuals per account.
  • Simultaneous vs. Successive: Nominations can be made simultaneously (where you explicitly split percentages among up to 4 people, totaling exactly 100%) or successively (where Nominee B gets the funds only if Nominee A passes away before the account holder)
  • Joint Accounts: If an account is held jointly (e.g., “Either or Survivor”), the nomination event is contingent upon the death of all depositors. The surviving joint holder always retains control of the funds over the nominee while alive.
  • Minor Nominees: If a minor is chosen as a nominee, the account holder must appoint an adult guardian/appointee who is authorized to receive the funds on the minor’s behalf if the contingent event occurs during their minority

Sections 45ZC and ZE define the nomination related to safe custody articles and Safe Deposit lockers. Section 45ZG which was inserted after an amendment on November 1 2025 indicate the determination of the priority of nomniation when there are successive nominations. It states as follows:

Priority of successive nominations (Sec 45ZG)

(1) Where the nomination is made in favour of more than one person successively under sub-section (1) of section 45ZA or sub-section (1) of section 45ZC or sub-section (1) of section 45ZE, the nomination shall be effective only in favour of one person in the following order of priority, namely:––

(a) nomination of the first nominee shall be effective if that nominee survives the person or persons who made the nomination;

(b) nomination of the second nominee shall become effective only after the death of the first nominee;

(c) nomination of any nominee lower in the order of nomination shall become effective only after the death of all the nominees whose names are higher in the order of nomination.

(2) Where the order of nomination is not mentioned, persons shall be deemed to have been nominated in the order in which their names appear in the nomination.

(3) The provisions of this section shall not apply to the nominations made simultaneously in favour of more than one person under sub-section (1) of section 45ZA.]

RBI’s nomination may also apply to “Missing Persons” as declared under the BSA. According to Section 111 BSA a person is presumed dead if he has been missing for 7 years continuously.

RBI also permits statement of “Percentage of Nomination” as if nominations settle ownership. This is against the principle that “Nomination is only transfer of custody and not transfer of ownership”.

Hence it may be debated and can be held invalid.

The Gazette notification GSR 790(E) from Ministry of Finance dated 27th October 2025 prescribes the Nomination Rules for the Banks.

This Gazette notification provides the option of “E-Nomination” which is not in conformity with the ITA 2000.

This Gazette Notification is also not in conformity with ITA 2000 in terms of defining the methods of authentication of nomination to include OTP.

In all the above nominations systems, “Nomination becomes effective only in case of death”. The DPDPA however seems to follow the Mental Health Care Act 2017 (s 14) and states that Nomination becomes effective in the case of “Incapacity” of the data principal which is defined as

” inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.”

This has a parallel in Section 14 of the Mental Healthcare Act, 2017, which allows a person to appoint a “nominated representative”. But unlike that Act, DPDPA provides no mechanism for certifying incapacity or for resolving conflicts with a guardian. Whether the provision works in practice needs examination.

The Considered view of the undersigned is that

  1. a) Nomination on “incapacity” needs additional safeguards, including how incapacity is to be certified to the Data Fiduciary and how the nominee’s role relates to that of a lawful guardian under Section 2(j).
  2. b) The Ministry of Finance Gazette Notification of 27th October 2025 needs revision in respect of electronic nomination.

Recently, RBI withdrew its notification in respect of opening of accounts by minors with “Independent” operation which was available after 10 years and was inconsistent with DPDPA definition of a “Child”.  Similarly, the above two anomalies may need to be corrected.

Under DPDPA, nomination should be treated as a transfer of custody of the data. On the death of the Data Principal, the purpose of processing generally comes to an end. Under Section 8(7), the Data Fiduciary must then erase the data unless retention is required by law, since continued storage only carries risk. Handing custody to the nominee, or erasing the data at the nominee’s request, discharges this obligation.

Multiple nominees create a practical problem. If they give conflicting instructions, for example one asking for custody and another for erasure, the Data Fiduciary has no way of knowing whom to follow..

The rights of the Data Principal are the rights of access, correction, erasure, grievance redressal and nomination. After death, only two of these remain meaningful: the right to take custody of the data and the right to have it erased. Once custody passes, the nominee holds the data as a trustee for the legal heirs and must deal with it only in that capacity. The other rights lose their purpose.

Also if the the nominee inherits all the rights of the data principal, he can nominate one or more persons as nominees to “exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules “. This also appears inconsistent since the original purpose of collection and processing no longer exists and the continued processing cannot be considered feasible after the death of the data principal.

Hence there needs to be a further discussion on this and an amendment of rules if required.

Naavi

About Vijayashankar Na

Naavi is a veteran Cyber Law specialist in India and is presently working from Bangalore as an Information Assurance Consultant. Pioneered concepts such as ITA 2008 compliance, Naavi is also the founder of Cyber Law College, a virtual Cyber Law Education institution. He now has been focusing on the projects such as Secure Digital India and Cyber Insurance
This entry was posted in Privacy. Bookmark the permalink.