Your rights under the Digital Personal Data Protection Act

Every time you sign up for an app, fill a loan form or book a doctor, someone collects your personal data. For years Indians had little say in how that data was used, sold or protected. A leaked phone number could bring a flood of spam calls, and nobody had to answer for it. The DPDP Act changes this. This guide explains your rights, what companies must do, and what you can do today, before the main parts take effect.

Key words in plain language

• Personal data: any data about you that can identify you, such as your name, phone number, photo, location or health record.
• Data Principal: you, the person the data is about. For a child (under 18), the parent or lawful guardian acts for the child.
• Data Fiduciary: the company, organisation or government body that decides why and how your data is used.
• Data Protection Board of India: the body that hears complaints and imposes penalties. It works as a fully digital office.

When the law applies

Parliament passed the Act in August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 with a phased timetable:

• From 13 November 2025: provisions setting up the Data Protection Board came into force. An amendment to the RTI Act made by the DPDP Act, restricting disclosure of personal information, also took effect; it has been challenged in the Supreme Court and the case is pending as of 2026.
• From about 13 November 2026: registration of consent managers (platforms that help you give, track and withdraw consent).
• From 13 May 2027: notice, consent, security, breach reporting, children's data and your rights as a Data Principal.

In early 2026 the government proposed shortening this timetable, but as of October 2026 no change had been notified. Members of the Board were also still being selected during 2026. Until the main parts apply, you can still make every request below; many companies already honour them.

Consent and notice

Your personal data may be processed only with your consent or for certain "legitimate uses" listed in the Act Sec 7 DPDP Act, such as data you voluntarily share for a specific purpose, or use by the State for benefits, services and licences. Consent must be free, specific, informed, unambiguous and given by a clear action Sec 6 DPDP Act. Pre-ticked boxes and "agree to everything" bundles do not meet this standard.

Before asking for consent, the company must give you a notice in clear language (available in English or any language in the Eighth Schedule of the Constitution) explaining what data it collects, why, and how to exercise your rights and complain Sec 5 DPDP Act. You can withdraw consent at any time, and withdrawing must be as easy as giving it.

Your rights

1. Right to information: a summary of your data being processed, what is done with it, and with whom it has been shared Sec 11.
2. Right to correction and erasure: correct inaccurate data, complete or update it, and have it erased once no longer needed for the purpose you agreed to Sec 12.
3. Right to grievance redressal: every company must have a readily available way to handle complaints, and must respond within 90 days under the Rules Sec 13.
4. Right to nominate: name someone to exercise your rights if you die or become incapable Sec 14.

Children, companies' duties and penalties

A company must get verifiable consent of a parent or lawful guardian before processing a child's data, and must not track, behaviourally monitor or target ads at children, or process data in a way likely to harm a child Sec 9. Schools, hospitals and child transport services have limited exemptions under the Rules.

Companies must keep data accurate, protect it with reasonable security safeguards, tell the Board and affected people about a data breach, and delete data when the purpose is over Sec 8. The Board can impose penalties of up to ₹250 crore for failing to take security safeguards, and up to ₹200 crore each for not reporting a breach or breaching children's protections.

You have duties too: no false or frivolous complaints, no impersonation, no false details Sec 15; the penalty can be up to ₹10,000. The Act also lets the government exempt its agencies for reasons such as security and public order Sec 17; critics say these exemptions are too wide, while the government says they are needed for governance.

Step by step

1. Read the notice before clicking "I agree". Refuse consent for purposes you do not need.
2. Write to the grievance officer (contact details are usually in the privacy policy). Ask what data is held, who it was shared with, and request correction, erasure or withdrawal of consent. Keep screenshots and dates.
3. Wait for the reply, up to 90 days once the Rules apply.
4. Complain to the Data Protection Board online if unresolved, once the relevant duties are in force. Appeals from the Board go to the Appellate Tribunal (TDSAT) within 60 days Sec 29.
5. If your data is used to cheat you, do not wait: call 1930 and report on cybercrime.gov.in.