Your data protection rights under the DPDP Act 2023, in plain language

Written and verified by the Grahak Mitra research team — an independent project documenting digital consumer self-help in India.

Last updated: 2026-07-11

The Digital Personal Data Protection (DPDP) Act, 2023 gives you — the person your data is about — a set of rights over your personal data: to know what an organisation holds about you and how it's being used, to have it corrected or completed or erased, to a grievance-redressal route, and to nominate someone to act for you. These are the rights the Act provides. The Act is passed; the detailed rules under it and the Data Protection Board that is meant to enforce them were still being rolled out, so exactly how you exercise each right — the process, the forms, the timelines, and the Board's role — is set by those rules as they are finalised, and is best checked on the official source rather than assumed to be fully live today.

In plain terms: the law is on the books and it names real rights, but a lot of the machinery that makes them routine to use is still being put in place. So treat what follows as "the rights the Act gives you", not as "buttons you can press today and force an instant result".

Some plain words first

The Act uses two terms it helps to know. You, the individual the personal data is about, are the data principal. The organisation that decides how and why your data is handled — a company, an app, a service — is the data fiduciary. The rights below are yours as the data principal; the duties are the fiduciary's.

Your DPDP rights — what each one means

This table explains, in everyday language, the rights the Act provides. It is a plain-language guide, not the legal text and not a description of a fully-operational process — the exact scope, the conditions, and how you actually use each right are set by the Act and the rules under it, so check the linked official source for the current detail.

The honest scope — read this before you rely on a right

The DPDP Act, 2023 gives you these rights — but the detailed rules under it and the Data Protection Board's operational enforcement were still being rolled out, so these are the rights the Act provides, with the operational mechanics of how you exercise them, the Board's process, and any timelines deferred to the official source as they are finalised. That means this page does not describe a fully-live enforcement regime, does not set out a Board complaint process or a day-count, and does not tell you that you can force erasure today and it must happen. What it does tell you is real: the rights exist in law, and the first, concrete way to exercise any of them is already available to you — through the organisation itself.

How to actually exercise a right — the first step

1. Go to the organisation's own grievance or data channel first. The data fiduciary — the company or app that holds your data — is required to provide a way to raise these requests. Send your request (to know, to correct, or to erase) through its grievance mechanism or published contact for data matters.
2. Put it in writing and keep a copy. Write down what you're asking for, send it through the channel, and keep the request and any reference number. A written record is what shows you exercised your right and when.
3. Give it the organisation's response window. Let the organisation act on the request. The exact obligations and timelines are set by the rules under the Act as they are notified — check the linked official source for the current position rather than assuming a specific deadline.
4. If it isn't resolved, escalate on the official terms. Where the organisation doesn't act, the escalation and the Data Protection Board's role are governed by the rules as they come into force. The official source is where the current process lives; the National Consumer Helpline (1915) can also guide you on a data-grievance in the meantime.

Where this connects to the rest of your data

Two neighbouring situations have their own concrete steps. If your data was exposed in a company's breach, exercising a right is only part of the response — see what to do when your data was in a breach for the practical damage-limiting moves. And if a loan app harvested your contacts or photos, the DPDP right to ask for erasure comes together with the RBI collection limit — see a loan app took my contacts and photos: your data rights.

The honest bottom line

Your DPDP rights are real and worth using: you can ask to know, to correct, and to erase, and you have a right to be heard on a data grievance. But the Act works as a framework that is still being fully switched on — the rules and the Board's enforcement are being rolled out — so it is a right to request and to be heard on the law's terms, not a guaranteed, instant, self-executing result. Start with the organisation, keep your record, and check the official source for how the process stands as it is finalised.