DPDP Act India: Your Data Privacy Rights Explained

You open a shopping app to order something. It asks for your name, phone number, email address, and delivery location. Then comes the request for notifications. A social media app wants access to your contacts. A website asks you to accept cookies. Another service wants you to upload your photograph, verify your identity, or share personal details before you can continue.

Most of us click Agree and move on. We have things to do, messages to answer, payments to make, and work waiting for us. Reading a long privacy policy feels like an unnecessary delay.

But have you ever wondered what happens to all that information after you share it? Who can use it? How long can a company keep it? What happens if your personal details are exposed in a data breach? And if you decide that you no longer want a company to use your information, can you ask it to stop?

India's Digital Personal Data Protection Act, 2023, commonly called the DPDP Act, was introduced to establish a legal framework for handling digital personal data. The Digital Personal Data Protection Rules, 2025, provide further details about how the framework is intended to work.

This is an important development for anyone who uses digital payments, shopping platforms, social media, online education, banking apps, or other internet services. Your personal information has become part of everyday digital life, and understanding how the law treats that information is no longer something only lawyers and technology companies need to worry about.

However, there is one crucial detail: the Act and its Rules have a phased commencement schedule. As of October 2026, not every provision is fully operative. Understanding what the law provides, what is already in force, and what is scheduled to take effect later is essential to understanding your actual rights today.

📌 Key Takeaways

• ✅ India's DPDP Act, 2023, establishes a framework for protecting digital personal data.
• ✅ The DPDP Rules, 2025, were notified with a phased implementation schedule.
• ✅ The framework provides for rights involving consent, access, correction, erasure, grievances, and nomination.
• ✅ Withdrawal of consent does not automatically mean that every record must be deleted immediately.
• ✅ Companies may have lawful reasons to retain certain information, even when a person requests erasure.
• ✅ Knowing the implementation timeline is as important as knowing what the law promises.

What Is India's DPDP Act?

The Digital Personal Data Protection Act, 2023, is an Indian law that establishes rules for processing digital personal data. It received presidential assent on 11 August 2023. The framework was subsequently supplemented by the Digital Personal Data Protection Rules, 2025, which were published in November 2025.

In simple terms, the law aims to establish responsibilities for organisations that determine why and how digital personal data is processed, while giving individuals rights in relation to their information.

For example, imagine that you register on an online shopping website. The company collects your name, phone number, address, and order details to provide its service. It must handle the information within the applicable legal framework rather than treating your personal data as something it can use without limits.

The law uses two important terms:

• Data Principal: The individual to whom the personal data relates. In everyday language, this usually means you when a company processes your personal information.

• Data Fiduciary: The person or organisation that determines the purpose and means of processing personal data. Depending on the situation, this could be a business, platform, or other organisation.

The law does not mean that every organisation must stop collecting personal information. Many services need some information to operate. Instead, the framework sets conditions and responsibilities for the processing of digital personal data.

You can read the original legislation through the Government of India's official Data Protection Framework page.

The Most Important Detail: Is the DPDP Law Fully in Force?

This is where many online explanations can become confusing. A law may have been passed, and its rules may have been notified, without every obligation becoming enforceable on the same date.

The DPDP Rules, 2025, provide for phased commencement. Some provisions came into force upon publication, while other provisions are scheduled to commence one year or eighteen months after publication in the Official Gazette.

The notification published in the Gazette on 13 November 2025 specifies the following broad schedule:

• From publication: Rules 1, 2, and 17 to 21 came into force upon publication. These include preliminary provisions and specified institutional or administrative arrangements.

• After one year: Rule 4, concerning the registration and obligations of Consent Managers, is scheduled to commence one year after publication.

• After eighteen months: Rules 3, 5 to 16, 22, and 23 are scheduled to commence eighteen months after publication. These include important operational requirements concerning notices, consent, and other compliance matters.

That eighteen-month point falls in May 2027. The commencement of the corresponding provisions of the Act must also be considered, because the Act itself contains phased commencement arrangements.

This distinction matters for consumers. It would be inaccurate to assume that every right, every company obligation, and every complaint mechanism described in the Act is already operating in exactly the same way as it will after full implementation.

For the latest official details, consult the Digital Personal Data Protection Rules, 2025 notification and the Ministry of Electronics and Information Technology's data protection framework page.

What Rights Does the DPDP Framework Provide?

The Act sets out rights for individuals whose personal data is processed under the framework. These rights are important, but their practical exercise depends on the relevant provisions coming into force and on the circumstances of the processing.

1. The Right to Information About Your Personal Data

One of the biggest problems with digital services is that users often have little idea what information a company has collected or why it needs it.

Under the framework, individuals can seek information about personal data being processed and certain details about its processing, subject to the applicable legal provisions.

Imagine that you signed up for an online service years ago and can no longer remember whether you shared your phone number, date of birth, or other information. The framework provides a route for individuals to seek information about their data and its handling.

This is not necessarily a right to obtain every internal document, confidential record, or piece of information held by a company. The scope of the right is determined by the law.

2. The Right to Correct or Update Personal Data

Incorrect personal information can cause problems. A wrong phone number, outdated address, or inaccurate personal detail may affect communication and service delivery.

The DPDP framework provides for requesting the correction of inaccurate or misleading personal data, completion of incomplete data, and updating of information where applicable.

For example, if an online service has an outdated contact number, you may request that the information be updated through the applicable process.

3. The Right to Request Erasure

Suppose you stop using a digital service. You close your account and no longer want the company to retain personal information that it does not need.

The Act provides a right to request erasure of personal data in specified circumstances. However, this is not an unconditional guarantee that every record will be deleted immediately whenever a user asks.

An organisation may need to retain certain information to comply with another law or fulfil a legally recognised obligation. The relevant provisions and circumstances determine whether data can be erased.

For example, deleting a shopping account does not necessarily mean that a business can erase every transaction record it is legally required to retain. Account deletion, marketing preferences, and statutory record retention may involve different requirements.

4. The Right to Withdraw Consent

Consent is an important part of the DPDP framework. Where an organisation relies on consent as its legal basis for processing, the Act provides for withdrawal of that consent.

Consider a service that asks permission to use your personal information for a particular purpose. You may later decide that you no longer want that processing to continue. The framework is intended to allow consent to be withdrawn, with the consequences set out in the law.

Withdrawal should not be confused with automatic deletion of all previously collected data. The organisation may have separate legal obligations or another permitted basis for retaining or processing particular information.

The practical lesson is simple: consent should not be treated as an irreversible decision, but withdrawing it does not automatically cancel every lawful use of data.

5. The Right to Grievance Redressal

What happens if you raise a privacy concern with a company and receive no satisfactory response?

The framework provides for grievance redressal and establishes the Data Protection Board of India as part of the enforcement structure. The Act also sets out a process through which complaints and appeals can be handled under the applicable provisions.

In practice, you should first identify the company's designated grievance channel and preserve the details of your complaint. Once the relevant legal provisions and procedures apply, the statutory route may provide an additional mechanism for seeking redressal.

Do not assume that filing a complaint automatically guarantees compensation or an immediate order against a company. The outcome depends on the facts, applicable law, and the decision of the relevant authority.

6. The Right to Nominate Another Person

The Act provides for an individual to nominate another person to exercise certain data-related rights on their behalf in the event of death or incapacity, subject to the law.

This recognises that personal data rights can become relevant even when an individual is no longer able to exercise them personally.

What Must Companies Do With Your Data?

The DPDP framework is not limited to giving individuals rights. It also establishes responsibilities for organisations that determine the purpose and means of processing personal data.

Clear Notices and Meaningful Consent

The Rules set out requirements for notices explaining the personal data being collected and the purposes for which it will be processed. The aim is to make the relevant information understandable rather than burying it in an unclear or confusing statement.

The consent provisions also establish conditions for valid consent where consent is the basis for processing. Consent should be connected to a specified purpose and given through a clear affirmative action, in accordance with the law.

However, the phased commencement schedule is important. The operational requirements under these provisions are not all fully applicable as of October 2026 merely because the final Rules have been notified.

Reasonable Security Safeguards

Personal data can become a serious liability when it is exposed through a security incident. Phone numbers, email addresses, account information, and other details may be misused if they fall into the wrong hands.

The DPDP framework provides for security safeguards and responsibilities concerning personal data breaches. The Rules specify requirements relating to security measures and breach notifications as part of the wider compliance framework.

This does not mean that data breaches will become impossible. Security depends on technical controls, organisational practices, staff awareness, and effective implementation. The purpose of the law is to establish accountability and obligations, not to promise that every system will be perfectly secure.

Special Considerations for Children's Data

The Act includes additional requirements concerning the processing of children's personal data, including provisions for verifiable parental or guardian consent, subject to the applicable law and exceptions.

This matters because children increasingly use educational apps, games, video platforms, and online services. Their personal information deserves careful handling, particularly where services collect information about their behaviour or activities.

The framework also contains provisions concerning persons with disabilities who may need a lawful guardian in specified circumstances. These requirements must be read alongside the relevant provisions and commencement dates.

What Does the DPDP Act Mean for Everyday Indians?

Legal provisions can sound abstract until they are connected to ordinary situations. Consider a few examples of where data protection becomes relevant.

When a Shopping App Collects Your Information

A shopping platform may need your address and contact details to deliver an order. That does not automatically mean every requested piece of information is necessary for every purpose.

Pay attention to the purpose for which the information is requested. Check whether the app explains why it needs the information, and review its privacy and grievance channels if something seems unclear.

When a Company Keeps Sending Promotional Messages

You may have registered for a service and later started receiving promotional communication. Check the service's available communication preferences and consent controls. Depending on the nature of the processing, you may be able to withdraw relevant consent or use another applicable opt-out process.

Remember that not all processing necessarily depends on consent. Some processing may be permitted on another basis under the Act, so the exact legal position depends on the circumstances.

When You Close an Account

Closing an account may stop your access to a service, but it does not necessarily mean that every piece of associated data disappears immediately.

Look for the service's account deletion process and privacy information. If you want data erased, make the request clearly and keep a record of the response. Certain information may still need to be retained where the law requires it.

When Your Personal Information Is Exposed

If you learn that a service has suffered a data breach, take practical precautions. Change affected passwords, secure your email account, enable two-factor authentication where available, and remain alert to suspicious calls or messages.

Never share an OTP, banking PIN, or password with someone claiming to help you resolve a data breach. A privacy incident can create opportunities for scammers to impersonate a company or government authority.

How to Make a Data-Related Request to a Company

You do not need to begin with complicated legal language to raise a privacy concern. A clear, documented request is a sensible starting point, subject to the rights and procedures that are applicable at the time.

• Step 1: Identify the organisation. Find the official website or app of the service that holds your information.

• Step 2: Locate the privacy or grievance channel. Check the privacy policy, help centre, or contact section for the relevant procedure.

• Step 3: Explain your request. State whether you want information about your data, a correction, an update, erasure where applicable, or clarification about consent.

• Step 4: Include sufficient identifying information safely. Provide only what is reasonably necessary to identify your account. Do not send passwords, OTPs, or unnecessary sensitive documents.

• Step 5: Keep a record. Save your request, the date, any reference number, and the response you receive.

• Step 6: Escalate if appropriate. If the issue remains unresolved, check the statutory complaint process and the rules that are in force at that time. Do not assume every future procedure is already operational.

A request should be specific and reasonable. For example, you can identify the account concerned and clearly state which information or action you are asking about. This makes it easier for the organisation to understand your concern.

What the DPDP Framework Does Not Automatically Guarantee

The DPDP Act is an important development, but it should not be mistaken for a guarantee that all digital privacy problems will disappear.

It Does Not Mean Every Data Request Is Illegal

Digital services often need personal information to deliver products, verify accounts, process transactions, or meet legal requirements. The relevant question is whether the processing complies with the applicable law, not whether a company collects any personal data at all.

It Does Not Mean Every Request for Deletion Must Succeed

Erasure rights are subject to the Act and relevant legal requirements. Organisations may have reasons to retain certain information. Users should not assume that closing an account erases all transaction, compliance, or legally required records.

It Does Not Prevent Every Data Breach

No law can make every digital system immune to cyberattacks, human error, or security failures. Effective protection also depends on implementation, organisational accountability, security practices, and enforcement.

It Does Not Remove the Need for Personal Caution

You should still use strong passwords, limit unnecessary app permissions, avoid suspicious links, and be careful about the photographs and documents you upload. Legal rights and sensible digital habits work best together.

It Does Not Mean Every Provision Is Already Fully Enforceable

This is particularly important in October 2026. The Act and Rules have phased commencement arrangements. Some requirements have taken effect, while others are scheduled for later dates. The relevant notification and applicable commencement provisions should be checked before making a legal claim about a specific obligation.

The New Challenge: AI, Deepfakes, and Voice Cloning

Data privacy becomes even more complicated as artificial intelligence tools become more capable. A photograph, voice recording, or other personal information may be used in ways that the person sharing it never expected.

Voice-cloning tools can imitate a person's voice. Deepfake technology can create convincing synthetic images or videos. Other AI systems can analyse information to generate predictions or inferences about people.

These technologies raise questions about consent, misuse, identity, and accountability. However, it would be inaccurate to say that the DPDP Act automatically resolves every issue involving AI-generated content, impersonation, copyright, or criminal fraud. The applicable legal rules depend on the conduct and circumstances involved.

For ordinary users, a few precautions remain valuable: share voice recordings and personal documents carefully, verify unusual requests through a trusted channel, and avoid assuming that a familiar voice or realistic video proves a person's identity.

As AI becomes more widely used, understanding personal data protection is part of understanding digital safety. Privacy is not only about what an app knows today; it is also about how personal information could be used in the future.

Frequently Asked Questions

1. What is the DPDP Act in India?

The Digital Personal Data Protection Act, 2023, establishes a legal framework for processing digital personal data in India. The DPDP Rules, 2025, provide additional implementation requirements. Both must be read with their respective commencement provisions.

2. Can I ask a company to delete my personal data?

The Act provides a right to request erasure in specified circumstances, subject to applicable legal requirements. A company may have lawful reasons to retain certain information. The right should not be understood as an unconditional guarantee of immediate deletion of every record.

3. Can I withdraw my consent after sharing personal data?

The Act provides for withdrawal of consent where consent is the basis for processing. The consequences depend on the applicable provisions and circumstances. Withdrawal does not automatically erase every record or prevent all processing that may lawfully continue on another basis.

4. Are all DPDP Act provisions fully applicable in October 2026?

No. The Act and the DPDP Rules, 2025, have phased commencement arrangements. Some provisions have come into force, while others are scheduled to commence later. Check the official Gazette notification and current government guidance for the status of a particular provision.

5. What should I do if a company does not respond to my privacy request?

Keep a copy of your request and the company's response, if any. Follow the organisation's published grievance process. If the issue remains unresolved, check the applicable statutory complaint procedure and whether the relevant provisions and mechanism are in force.

6. Does the DPDP Act protect me from deepfakes and voice cloning?

The Act concerns digital personal data and its processing, but it does not automatically resolve every legal issue involving deepfakes, voice cloning, impersonation, or fraud. The applicable protections may depend on the nature of the conduct and other relevant laws.

7. Where can I read the official DPDP Rules?

You can read the official notification on the Ministry of Electronics and Information Technology website: Digital Personal Data Protection Rules, 2025. You can also consult the Ministry's Data Protection Framework page for official materials.

Your Personal Data Deserves More Than a Quick Click

Most of us did not grow up thinking carefully about digital privacy. We learned to use smartphones, make online payments, join social networks, and register for apps because these tools made life easier. Sharing personal information gradually became part of the process.

The problem is not that every app is dangerous or every company has bad intentions. The problem is that personal data can be valuable, and the person sharing it may not always understand how it is collected, used, stored, or shared.

India's DPDP framework is an important step towards establishing clearer responsibilities and rights. But a law becomes meaningful through implementation, awareness, compliance, and effective ways to address complaints.

For individuals, the first step is to become more deliberate. Read the important parts of privacy notices. Question unnecessary permissions. Keep records of serious privacy concerns. Learn how to use the rights available under the law, while checking which provisions are currently in force.

Your data may exist on a company's servers, but it de

scribes your life, your identity, and your activities. Understanding the rules that govern it is not merely a technical exercise. It is part of being an informed citizen in a digital society.

The next time an app asks you to click Agree, take a moment to ask a simple question: do I understand what I am sharing, and why?

Note: This article is for general information and public awareness, not legal advice. It describes the DPDP framework as of October 2026. For a specific dispute or legal obligation, consult the official Act, Rules, commencement notifications, and a qualified legal professional.

As digital privacy becomes increasingly important, understanding the risks of emerging technology is equally essential. The New Scam: AI Is Cloning Your Voice to Fool Your Own Parents explains how voice-cloning technology can be misused to deceive families, while Why Lonely Indians Are Falling in Love With AI Chatbots explores another side of our growing dependence on digital technology.

Official sources: Ministry of Electronics and Information Technology — Data Protection Framework; Digital Personal Data Protection Rules, 2025 — Official Gazette notification; Press Information Bureau — DPDP Rules, 2025.