You work for a fintech company. A known troublemaker — someone who has previously harassed your support staff and left multiple fake reviews — suddenly raises a Right to Access and Right to Rectification request under the DPDPA. You suspect the intent is to burden your team and gather internal data to fuel more public complaints.

You’re tempted to push back or delay. After all, the person’s clearly acting in bad faith. But can you?

How would you respond?

• Can intent or motive be used to deny or delay a data subject request under GDPR or DPDPA?
• What safeguards or red flags should you document internally before making a decision?
• If you do respond, how would you protect your team from further harassment while still staying compliant?

Use this case to explore the fine line between lawful refusal and lawful obligation.