DPDP Act: your data rights in plain language

Written and verified by the Grahak Mitra research team — an independent project documenting digital consumer self-help in India.

Last updated: 3 October 2026

The Digital Personal Data Protection (DPDP) Act, 2023 gives you — the person your data is about — a set of rights over your personal data: to know what an organisation holds about you and how it's being used, to have it corrected or completed or erased, to a grievance-redressal route, and to nominate someone to act for you. These are the rights the Act provides — from a date that has not arrived yet. The government notified the rules under the Act in November 2025 and set the Act to start in stages. The sections that give you these rights, and that bind an organisation to act on them, start in mid-May 2027 — eighteen months after that notification. Until then you can still write to an organisation and ask; what changes in mid-May 2027 is that the Act requires it to act.

In plain terms: the law is on the books and it names real rights, but those rights start on a set date, and that date has not come yet. So treat what follows as "the rights the Act gives you from mid-May 2027", not as "buttons you can press today and force an instant result".

Some plain words first

The Act uses two terms it helps to know. You, the individual the personal data is about, are the data principal. The organisation that decides how and why your data is handled — a company, an app, a service — is the data fiduciary. The rights below are yours as the data principal; the duties are the fiduciary's.

Your DPDP rights — what each one means

This table explains, in everyday language, the rights the Act provides from mid-May 2027. It is a plain-language guide, not the legal text and not a description of a fully-operational process — the exact scope, the conditions, and how you actually use each right are set by the Act and the rules under it, so check the linked official source for the current detail.

Your DPDP rights — what each one means
Right the Act gives you	What it means, in plain words
To know what's held about you	You can ask an organisation what personal data of yours it is processing and a summary of what it's doing with it — so the handling of your data isn't invisible to you.
To correction, completion, and updating	If the data an organisation holds about you is wrong, incomplete, or out of date, you can ask for it to be corrected, completed, or updated.
To erasure	You can ask for your personal data to be erased, on the terms and subject to the exceptions the Act sets — for example, where the organisation is required by another law to keep it. It is a right to request erasure on those terms, not a guarantee that everything is wiped the instant you ask.
To grievance redressal	You have a right to a route for complaints about how your data is handled — starting with the organisation's own grievance mechanism, which the rules require to respond within a period of no more than ninety days.
To nominate someone	You can nominate another person to exercise your rights on your behalf — for instance in the event of your death or incapacity.

The honest scope — read this before you rely on a right

The DPDP Act, 2023 gives you these rights — but they are not in force yet. The government notified the Digital Personal Data Protection Rules, 2025 in November 2025 and set the Act to start in three stages. In force today is the groundwork: the definitions and the provisions that set up the Data Protection Board of India. The sections that carry your rights, the organisation's duties, and the Board's power to act on your complaint start eighteen months after that notification — in mid-May 2027. That means this page does not describe an enforcement system you can use today, and does not tell you that you can force erasure today and it must happen. What it does tell you is real: the rights are in the law with a start date, and the first, concrete step is already open to you — writing to the organisation itself.

How to actually exercise a right — the first step

Go to the organisation's own grievance or data channel first. From mid-May 2027 the Act requires the data fiduciary — the company or app that holds your data — to publish how to make these requests and to run a grievance system. Today, look for a grievance officer or a privacy contact on its website or app. Send your request (to know, to correct, or to erase) through its grievance mechanism or published contact for data matters.
Put it in writing and keep a copy. Write down what you're asking for, send it through the channel, and keep the request and any reference number. A written record is what shows you exercised your right and when.
Give it time to respond. From mid-May 2027 the rules cap the time an organisation's grievance system may take to respond at ninety days, and the government's summary of the rules says requests to access, correct, update or erase data must be dealt with within ninety days. Before that date the Act sets no deadline for the organisation, so note the date you wrote and follow up in writing.
If it isn't resolved, know where escalation stands. From mid-May 2027 you can complain to the Data Protection Board of India — but the Act requires you to use the organisation's own grievance route first. The Board is designed to work online: the government says people will file and track complaints through a portal and an app, and a Board decision can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The part of the Act that lets the Board act on your complaint is not in force before that date, and this page gives no portal address because the official sources linked below do not give one. Until then, the National Consumer Helpline (1915) can guide you on a data-grievance.

Where this connects to the rest of your data

Two neighbouring situations have their own concrete steps. If your data was exposed in a company's breach, exercising a right is only part of the response — see what to do when your data was in a breach for the practical damage-limiting moves. And if a loan app harvested your contacts or photos, the RBI's lending rules already let you withdraw consent and have a regulated lender delete your data, ahead of the DPDP right to erasure — see a loan app took my contacts and photos: your data rights.

The honest bottom line

Your DPDP rights are real, and they have a start date. From mid-May 2027 you can ask to know, to correct, and to erase; the organisation's grievance system must respond within ninety days; and the Data Protection Board can take your complaint once you have tried the organisation first. Until then the Act does not bind the organisation to act, though you can still ask in writing. Even once it is in force, it is a right to request and to be heard on the law's terms, not a guaranteed, instant, self-executing result. Start with the organisation, keep your record, and check the official source for how the process stands.

Was this helpful? (anonymous — no sign-up, nothing stored about you)