Your rights over your personal data in India, explained

At a glance

India’s DPDP Act gives you five core rights over your personal data: the right to know what a company holds about you, to have errors corrected, to have your data deleted, to withdraw consent you earlier gave, and to complain if an organisation doesn’t listen. You can use these against any business that collects your data — and it must respond.

Educational resource only. This explains the rights India’s Digital Personal Data Protection Act, 2023 (DPDP Act) gives you as an individual; it is not formal legal advice.

Under the DPDP Act you are the Data Principal — the person the data is about — and the organisation holding your data is the Data Fiduciary. These rights are the practical power that role gives you. Each one is a request you make to the company; the law obliges it to act.

The right to know what’s held about you

You can ask any organisation for a summary of the personal data it holds on you, and what it’s doing with it.

This is the right to access (Section 11). If an app, bank or service has collected your details, you can ask it to tell you what personal data it holds, how it’s being used, and who else it has been shared with. It turns the black box — “what do they even have on me?” — into something you can see. Companies must have a way to receive and answer this request.

The right to correct and to delete

If a company’s records about you are wrong, you can have them fixed; once your data has served its purpose, you can have it erased.

Two rights sit together here (Section 12). The right to correction lets you fix or update inaccurate, incomplete or outdated information a company holds — a wrong phone number, an old address, a misspelt name. The right to erasure lets you ask a company to delete your personal data once the purpose it was collected for is over, or once you withdraw your consent.

Erasure isn’t unlimited — a business can keep data it’s legally required to retain (for example, records a tax or sectoral rule forces it to hold for a set period). But outside those specific legal duties, “we’d just rather keep it” is not a valid reason to hold on to your data.

The right to withdraw consent

Permission you gave once is not permanent — you can take it back, and it must be as easy to withdraw as it was to give.

When you consented to a company using your data, that consent was tied to a purpose. The DPDP Act lets you withdraw that consent at any time (Section 6). The law is explicit that pulling your consent should be as simple as granting it was — no buried menus, no obstacle course. Once you withdraw, the organisation must stop the processing that relied on that consent and, in most cases, move to delete the data.

The right to complain — and to nominate

Every organisation must give you a way to raise a grievance, and you can escalate if it’s ignored.

If a company won’t honour your rights, you’re not stuck. Every Data Fiduciary must offer an accessible grievance-redressal route (Section 13) — a named contact or channel to complain to. If that doesn’t resolve things, you can escalate to the Data Protection Board of India, the regulator set up to hear these complaints.

There’s also a quieter right worth knowing: the right to nominate (Section 14). You can name someone to exercise your rights on your behalf if you die or become incapacitated — so your digital accounts and data don’t simply become inaccessible.

What these rights don’t cover

The rights are strong, but they’re not absolute — a few limits change what you can expect.

Keep two things in mind so the rights don’t mislead you. First, erasure gives way to genuine legal retention duties, as noted above. Second, some uses of your data don’t rely on your consent at all — the law allows certain “legitimate uses” (for example, when you’ve approached a business voluntarily for a service, or for specific state functions). Where a use is lawful without consent, withdrawing consent won’t switch it off. These are narrow carve-outs, not a loophole that swallows your rights.

FAQ