How to ask an app what data it holds about you (right to access)

At a glance

Under India’s DPDP Act you can ask any company for a summary of the personal data it holds about you, what it’s using the data for, and who it has shared it with. This is your right to access. You make the request in writing to the company’s privacy contact or through its app, and it must respond — you don’t need a reason or a lawyer.

Educational resource only. This explains the right to access under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and how to use it; it is not formal legal advice.

The situation

You’ve handed your details to dozens of apps, sites and services over the years — and you have no real idea what any of them still hold, or who they’ve passed it to. The right to access is how you turn that black box into a list you can actually see.

What you’re actually entitled to see

You can ask for a summary of your data, the purposes it’s used for, and who it’s been shared with.

The DPDP Act gives you a right to access (Section 11). On request, a company should tell you:

• A summary of the personal data it holds about you.
• What it’s doing with it — the purposes the data is being processed for.
• Who else has received it — the other companies or categories of recipients it has been shared with.

This isn’t a favour the company chooses to grant. It’s an obligation, and it applies whether the “company” is a giant platform or a small local service that took your details digitally.

Why this right is worth using

Seeing what’s held is the first move before you correct or delete anything.

Access is the right that powers the others. You can’t sensibly ask to fix an error until you’ve seen the record, and you can’t judge what to delete until you know what’s there. An access request often surfaces surprises — old addresses, data shared with partners you don’t recognise, information kept long after you stopped using the service. Once you can see it, your correction and erasure rights become concrete rather than guesswork.

How to make an access request, step by step

A short written request to the company’s privacy channel is enough — no form, no fee, no reason required.

1. Find the right contact. Check the app or website’s privacy notice for its grievance officer / Data Protection Officer or a “Privacy” / “Your data” contact. Every organisation must provide one.
2. Put the request in writing. Email or use the in-app request option. State that you are exercising your right to access under the DPDP Act.
3. Ask the three questions plainly. Request (a) a summary of the personal data they hold on you, (b) the purposes they’re using it for, and © the recipients or categories of recipients they’ve shared it with.
4. Help them find you. Give the email address or phone number you registered with, so they can locate your records.
5. Set a response expectation. Ask them to respond in a reasonable, defined time, and to send the summary in a readable format.
6. Keep a copy. Save your request and their reply.

A ready-to-use line: “Under the DPDP Act, please provide a summary of the personal data you hold about me, the purposes for which it is processed, and the recipients or categories of recipients with whom it has been shared.”

What to do if they stall

Ignored or fobbed off? Escalate through the grievance route, then the regulator.

If a company doesn’t respond, or gives you a vague brush-off, start with its grievance-redressal channel — a step every organisation must offer. If that fails to resolve things, you can escalate to the Data Protection Board of India. Your saved written request and any (non-)response is exactly the record that makes escalation easy.

FAQ