Individuals
Your Data, Your Rights
Your rights over your personal data under India's Digital Personal Data Protection Act — what you're entitled to, how to use each right, and what to do when a company gets it wrong. Written in plain English, for you rather than for lawyers.
01
What's the new data privacy law in India? A plain-English guideIndia now has a dedicated data privacy law — the DPDP Act. Here's what it is, who it protects, and what it means for your Aadhaar, PAN, phone number and other personal data.Your rights over your personal data in India, explainedUnder India's DPDP Act you have real rights over your personal data — to see it, correct it, delete it, withdraw consent and complain. Here's each one in plain English.What the government is doing to protect your personal dataIndia has passed a data privacy law, set up a regulator, and put real penalties behind it. Here's what the government has actually done to protect your personal data — in plain English."I agreed to the terms" doesn't mean you've lost your data rightsClicking "I Agree" doesn't sign your privacy away. Under India's DPDP Act your data rights stay with you — and a single blanket agreement often isn't valid consent at all.Do you have to give your real name on social media under DPDP?No — India's DPDP Act does not require you to use your real name on social media. Here's what the Act actually governs, and which rules the real-name question really belongs to.Understanding the law
02
The right to erasure in India: can you really make a company delete your data?Yes — under India's DPDP Act you can ask a company to delete your personal data. Here's when erasure applies, the one big exception, and how to make the request, step by step.How to read a privacy notice before you click "I Agree": a plain checklistBefore you tap "I Agree," a 60-second checklist for reading a privacy notice under India's DPDP Act — what it must tell you, and the red flags that mean don't consent yet.You can take it back: how to withdraw consent from an app or service in IndiaYou can withdraw data consent from any app or service — and under India's DPDP Act it must be as easy as giving it was. Here's what withdrawal means and how to do it, step by step.How to ask an app what data it holds about you (right to access)Under India's DPDP Act you can ask any app or company to show what personal data it holds about you and what it's doing with it. Here's exactly how to make an access request, step by step.Can an Indian company charge you a fee to delete your data?No — under India's DPDP Act, exercising your right to delete your data is not a paid service. Here's why a company can't put your erasure or withdrawal behind a fee, and the fine line to know.The right to nominate: making sure your digital accounts are handled after you're goneIndia's DPDP Act lets you nominate someone to handle your personal data and accounts if you die or can't act for yourself. Here's what the right to nominate means and how to use it.How to stop telemarketing calls and texts in India: DND, and where DPDP fitsThe fastest way to stop spam calls and SMS in India is TRAI's DND registry (1909 / DND app). Here's how to register, how to complain, and where your DPDP consent rights add extra teeth.The right to correction: how to fix errors in a company's records about youA wrong number, an old address, a misspelt name — under India's DPDP Act you can make a company correct, complete or update its records about you. Here's how, step by step.Your rights & how to exercise them
03
Your data was leaked — now what? A step-by-step guide for Indian citizensYour data leaked in India — Aadhaar, card, phone or password? A calm, step-by-step guide to what to do after a data breach: contain it, protect your money and Aadhaar, use your DPDP rights.What a company must tell you after a data breachIf a company loses your personal data, India's DPDP Act says it must tell you — without delay, in plain language. Here's exactly what that notice must include, and what to do if it doesn't.When things go wrong
04
What personal data can a business legally ask you for?A business can only ask for the personal data it genuinely needs for a stated purpose — and you can refuse the rest. Your rights on over-collection under India's DPDP Act, explained.Is it safe to share your Aadhaar or PAN? The real risksSharing your Aadhaar or PAN carries real misuse risks. What India's DPDP Act protects, when you can refuse, and how to share safely with masked Aadhaar and VID.Can a business legally ask for and store your documents?A business can ask for and keep your documents only for a purpose it needs them for — and must secure them and delete them when done. Your rights under India's DPDP Act.What details can your gym, society, or club legally ask from you?Gyms, societies and clubs often ask for ID copies, Aadhaar and personal details on membership forms. What they can legally require under India's DPDP Act — and what you can refuse.Is it legal for a courier to photograph your ID on delivery?Delivery agents sometimes photograph your Aadhaar or ID at the door. What India's DPDP Act allows, when a photo is justified, and how to refuse an unnecessary copy.Is your housing society's gate app violating your privacy?Visitor gate apps like MyGate and NoBrokerHood collect names, numbers and photos at the gate. What your housing society can legally collect under India's DPDP Act — and what you can refuse.Can a car showroom refuse to help you unless you give your phone number?Car showrooms often won't give a quote or test drive without your phone number. What India's DPDP Act says about making your number a condition of service — and how to push back.Do you have to give your real phone number for a blood test?Diagnostic labs ask for your phone number at every blood test — often for marketing. What India's DPDP Act requires, when a number is genuinely needed, and how to stop the spam.Are co-working spaces allowed to log your visitors' ID?Co-working reception desks often photograph visitors' Aadhaar or ID. What India's DPDP Act allows a space to collect, what's over-collection, and how to give the minimum.Restaurant feedback tablets: can you refuse to give your phone number?Feedback tablets and QR forms at restaurants often demand your phone number. What India's DPDP Act says about making it mandatory — and how to stop the marketing that follows.Can a hotel make a copy of your passport at check-in?Hotels ask for ID at check-in — but can they keep a full copy of your passport or Aadhaar? What India's DPDP Act allows, why the rule differs for foreign guests, and what you can refuse.What a business can legally ask you for
05
Is it legal for cinemas and concert venues to scan your face for entry?A cinema or concert scanning your face is collecting personal data under India's DPDP Act — so it needs your free consent and a clear notice. When you can refuse, explained.Can someone force you to scan your fingerprint for attendance?Can an employer or gym force your fingerprint? Under India's DPDP Act it turns on whether you're an employee or a customer — and Aadhaar can't be forced. Explained.Are gyms allowed to track your body metrics under India's data law?Weight, body-fat, measurements — a gym can record them if you agree, but under India's DPDP Act it's your personal data. What the gym can and can't do with it, explained.Biometric & body-data scenarios
06
What happens to your data after you delete a food-delivery or ride-hailing account?Deleting a Swiggy, Zomato, Uber or Ola account doesn't automatically erase your data. What an app can keep, what it must delete under India's DPDP Act, and how to make the deletion real.Is your WhatsApp data protected under India's DPDP Act?Your WhatsApp messages are end-to-end encrypted, but that's not the whole story. What India's DPDP Act protects about your WhatsApp data, what it doesn't, and the rights you can use.Can your employer read your personal chats on an office laptop under DPDP?Can your employer legally read your personal WhatsApp or email on a company laptop in India? What the DPDP Act governs, what it doesn't, and the practical rule to protect yourself.Are pre-checked newsletter sign-up boxes legal in India now?That newsletter box already ticked when you sign up? Under India's DPDP Act a pre-checked opt-in isn't valid consent. What it means for you, and what you can do.An app asked for my location and contacts — is that legal, and can I refuse?Can an app legally demand your location, contacts or photos — and can you refuse? What India's DPDP Act says about app permissions, when a refusal can't cost you the service, and your limits.Are free call-recording apps violating India's privacy law?Recording your own calls, the other person's consent, and what free call-recording apps quietly do with your recordings. What's legal in India — and the real risk.