Your rights under the Digital Personal Data Protection Act

What is the DPDP Act?

It is India’s law on how organisations collect and use your personal data in digital form. The Digital Personal Data Protection Act was passed in 2023, and the government notified the rules that put it into practice in November 2025. The rules give organisations 18 months to comply, in phases.

The law calls you a “data principal” and the organisation that decides how your data is used a “data fiduciary”. Any organisation that collects and processes personal data digitally, and decides how it is used, falls in the second group.

What rights do I have?

You can ask for a copy of your data, have it corrected or updated, ask for it to be erased, and nominate someone to act for you. These are the rights the government lists in its backgrounder on the rules:

• Access: ask an organisation for a copy of the personal data it holds about you.
• Correction and updating: have wrong or incomplete data fixed, or record a change such as a new address.
• Erasure: ask for your data to be removed in certain situations.
• Nomination: appoint someone to use these rights on your behalf.
• Complaint: raise a grievance with the organisation’s contact point, and file a complaint with the Data Protection Board.

Organisations must respond to requests for access, correction, updating or erasure within 90 days.

What must companies tell me before taking my data?

They must give a separate consent notice that states clearly what the data is for. It must set out the specific purpose for which the data is collected and used. Organisations must also display contact details for questions about personal data, such as a designated officer or Data Protection Officer.

You can also give, review and withdraw consent through a consent manager. This is an India-based company that runs a single, transparent and interoperable platform for managing consent across services, and it works under the Data Protection Board’s oversight. The consent manager framework begins on 13 November 2026.

What happens if my data is leaked?

The organisation must tell you without delay, in plain language, what happened and what it means for you. The notice must cover the likely impact, the steps taken, and who to contact for help. Organisations must also report breaches to the Data Protection Board.

The heaviest penalties in the Act apply to security failures.

Maximum penalties under the DPDP Act

• ₹250 crorefailing to keep reasonable security safeguards
• ₹200 crorefailing to report a breach, or breaching duties on children's data
• ₹50 croreany other violation

What about children’s data?

Organisations need verifiable consent from a parent or lawful guardian before processing a child’s data. The rules allow exceptions where processing relates to essential services such as healthcare, education or real-time safety, according to the government’s backgrounder.

Where do I complain?

To the organisation’s designated contact and to the Data Protection Board; appeals against the Board go to the Telecom Disputes Settlement and Appellate Tribunal. The government says the Board will be fully digital, with complaints filed and tracked online through a portal and a mobile app.

There is a catch. As of October 2026, the Board has no chairperson or members. It was established in law in November 2025, and two search-cum-selection committees, one chaired by the Cabinet Secretary, are handling appointments, LiveLaw reported. The Ministry of Electronics and Information Technology invited applications in May 2026, but no appointment has been announced, according to LiveLaw and the India Data Law tracker. A board without members cannot hear complaints or pass orders.

Do big companies face stricter rules?

Yes, organisations the government classes as significant data fiduciaries carry extra duties. According to the government’s backgrounder, they must have independent audits and carry out impact assessments, apply stricter checks to new or sensitive technologies, and follow government directions on restricted data, including storing it in India where required.

All organisations covered by the law must keep reasonable security safeguards, and it is failure on this count that attracts the highest penalty of ₹250 crore.

When do these rights actually start?

Most obligations on organisations, and the Board’s powers to inquire and penalise, apply from 13 May 2027. The rules set up the Board immediately on notification, start the consent manager framework a year later, and bring in most other duties after 18 months.

DPDP rules: when things take effect

1. 2023Digital Personal Data Protection Act passed
2. Nov 2025Rules notified; Data Protection Board established in law
3. 13 Nov 2026Consent manager framework begins
4. 13 May 2027Most obligations take effect, including the Board's powers to inquire and impose penalties