Your Rights Under the DPDP Act 2023: Access, Erasure, Grievance and Nomination

Under the Digital Personal Data Protection Act, 2023, you (the “Data Principal”) have the right to get a summary of your personal data and how it is processed (s.11), to correct, complete, update and erase it (s.12), to an effective grievance redressal from the company (s.13), and to nominate someone to exercise these rights if you die or become incapacitated (s.14). You can withdraw consent at any time, as easily as you gave it (s.6(4)). These rights become enforceable when the DPDP Rules’ 18-month transition ends on 13 May 2027. You must first use the company’s grievance process before complaining to the Data Protection Board, and a false or frivolous complaint can attract a penalty of up to ₹10,000.

Your four rights, explained

1. Right to access information (s.11). If you consented to processing, you can ask the company (the “Data Fiduciary”) for a summary of the personal data it processes about you, the processing activities, and the identities of other fiduciaries and processors it shared your data with.
2. Right to correction and erasure (s.12). You can ask the company to correct inaccurate data, complete incomplete data, update it, and erase data that is no longer needed for the purpose, unless the law requires it to be kept.
3. Right of grievance redressal (s.13). Every company must provide a readily available means of grievance redressal. Under section 13(3), you must exhaust this route before approaching the Data Protection Board.
4. Right to nominate (s.14). You can nominate another individual who will exercise your rights if you die or become unable to do so because of unsoundness of mind or infirmity.

The DPDP Rules, 2025 require companies to publish how you can make these requests and to respond within a period not exceeding 90 days.

Consent and how to withdraw it

Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Under section 6(4), you can withdraw consent at any time, and the ease of withdrawing must be comparable to the ease of giving it. After withdrawal, the company must stop processing (and have its processors stop) within a reasonable time, unless the law permits otherwise. Withdrawal does not undo processing already done.

Example: Kavita signed up for a Delhi gym’s app and ticked consent for marketing. She later finds her number sold to a loan company. Once the obligations are in force, she can withdraw consent in the app, ask for a summary of who her data was shared with (s.11), demand erasure (s.12) and, if ignored, complain to the Board.

When the rights become enforceable

The DPDP Rules, 2025 were notified on 14 November 2025. The provisions setting up the Data Protection Board took effect immediately. Consent manager provisions follow after 12 months. Most substantive obligations, including notice, consent, security safeguards, breach intimation and your rights under sections 11 to 14, apply after 18 months, that is from about 13 May 2027. MeitY consulted in early 2026 on shortening this window, but as on today no shorter deadline has been notified. Many large platforms already offer access and deletion tools, so use them now.

Your duties, and the ₹10,000 penalty

Section 15 places duties on you as a Data Principal: comply with the law while exercising rights; do not impersonate another person while giving personal data; do not suppress material information when providing data for an official document or ID; do not register a false or frivolous grievance or complaint with a company or the Board; and furnish only verifiably authentic information when seeking correction or erasure. Breach of these duties can attract a penalty of up to ₹10,000 under the Schedule to the Act.

Children’s data

A “child” under the Act is a person below 18. Before processing a child’s personal data, the company must obtain verifiable consent of the parent or lawful guardian (s.9), and must not do tracking, behavioural monitoring or targeted advertising directed at children, subject to exemptions in the Rules. Breach of children’s data obligations can attract penalties of up to ₹200 crore on the company.

What to do today about spam calls and data leaks

• Fraud calls and messages: report suspected fraud communication on Chakshu, the reporting facility on the Department of Telecommunications’ Sanchar Saathi portal (sancharsaathi.gov.in).
• Unwanted promotional calls and SMS: register your preferences on the Do Not Disturb (DND) registry by SMS or call to 1909, or through your operator’s app or TRAI’s DND app, and report violations.
• Money already lost: call 1930 or file on cybercrime.gov.in immediately, and inform your bank.
• Data leak by a company: write to its grievance officer asking what was exposed and what it is doing. Change passwords, enable two-factor authentication and watch for phishing.

Frequently asked questions

Can I complain to the Data Protection Board today?

The Board has been constituted, but most data principal rights and fiduciary obligations become enforceable from about 13 May 2027. You must also first use the company’s grievance process (s.13(3)).

Can I make a company delete my data?

Yes, under section 12 once in force, where the data is no longer needed and no law requires retention.

Is there a penalty for a fake complaint?

Yes. Breach of your duties under section 15, including false or frivolous complaints, can attract up to ₹10,000.

Does the Act cover data I gave on paper?

It covers digital personal data, including data collected offline and later digitised.

Can I get compensation from the Board?

The Board imposes penalties on companies; the Act does not provide for compensation to you through the Board. Other remedies, such as consumer or civil claims, depend on the facts.

Quick quiz

To learn your data and cyber rights properly, see Certificate Course in Everyday Law for Every Indian.

Sources

• Digital Personal Data Protection Act, 2023, sections 2, 6, 9, 11 to 15, 33 and the Schedule
• Digital Personal Data Protection Rules, 2025 (notified 14 November 2025)
• Press Information Bureau explainer on the DPDP Rules, November 2025
• Department of Telecommunications, Sanchar Saathi portal (Chakshu)
• TRAI, Telecom Commercial Communications Customer Preference Regulations, 2018

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.