Your data rights under the DPDP Act: what you can ask any company for
Under the Digital Personal Data Protection Act, 2023 you can ask a company for a summary of your personal data and who it was shared with, ask it to correct or erase data, withdraw consent as easily as you gave it, use its grievance channel, and nominate someone to act for you after death or incapacity. Companies must answer within the time they publish, at most 90 days. These duties apply fully from 13 May 2027.
Start with the company
Write to the company’s grievance officer or contact listed in its privacy notice. Say which right you are using and keep a copy. Only after this route can you complain to the Data Protection Board of India.
What erasure does not cover
A company can keep data that a law requires it to hold, for example tax or banking records. It must erase what it held only on your consent once you withdraw or the purpose is over.
No compensation, but real pressure
The Act does not award you damages; penalties go to the government. But a written request on record, followed by a complaint to the Board, is usually enough to get a company to act.
Key facts
| Right to access (s.11) | Summary of your data, the processing, and who it was shared with |
|---|---|
| Correction and erasure (s.12) | Fix wrong data; erase data no longer needed, unless a law requires it to be kept |
| Grievance (s.13) | The company must answer; maximum 90 days under the Rules |
| Nomination (s.14) | Name someone to use your rights after death or incapacity |
| Withdraw consent (s.6) | Must be as easy as giving it; processing on that consent then stops |
| Your duties (s.15) | No impersonation, no false complaints; penalty up to ₹10,000 |
| Applies fully from | 13 May 2027 |
Steps
- Find the company’s privacy notice and grievance contact
- Send a written request naming the right you are using
- Keep the date and wait for the reply, up to 90 days
- If unresolved, complain to the Data Protection Board of India
Questions
Can I stop marketing messages?
Yes. If they rely on your consent, withdraw it. The company must stop processing your data for that purpose.
Do these rights apply to government departments?
Many do, but the Act lets the government exempt some of its agencies for purposes such as security and law enforcement.
Sources
- PIB explainer on the DPDP Rules, 2025 (Nov 2025)
- DPDP Rules, 2025, Rule 14 90-day limit (S.S. Rana & Co.)
- DPDPA General Awareness guide (2026 edition), Dr. Naveen Kumar Sharma (Adv.)
Facts checked against these sources on 7 Oct 2026. Laws change; confirm before acting.
This guide is general information, not legal advice for your situation. Talk to an advocate before acting.
