Your Rights Under the DPDP Act

Right to a summary of your data (Section 11)
Ask a company you gave consent to for a summary of your data and what it does with it. You can also ask who else it shared your data with.
Right to correct and erase (Section 12)
Ask the company to correct, complete or update your data. You can also ask it to erase your data. It must erase unless it still needs the data for the purpose or another law (Section 12(3)).
Right to complain (Section 13)
The company must give you an easy way to complain. You must use it first, before you go to the Data Protection Board (Section 13(3)).
Right to nominate (Section 14)
Name another person to use your rights if you die or cannot act yourself. Rule 14(4) lets you name one or more people.

How to ask

Law: Each company must publish on its website or app how you can make a request. It must also say what details it needs to identify you, such as a username (Rule 14(1)). Send your request that way (Rule 14(2)).

How long the company has

Law: Rule 14(3) is about the company's grievance system. The company must publish the time it takes to answer grievances. That period must be reasonable and "not exceeding ninety days". The Rules do not set this limit for every rights request. These rules start on 13 May 2027.

Official text — DPDP Rules, 2025, Rule 14(3)

(3) Every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures.

If the company ignores you

First, use the company's complaint process. Then you can go to the Data Protection Board (Section 13(3)).

Official text — DPDP Act, 2023, Section 13(3)

(3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.

Official text — DPDP Act, 2023, Section 12(3)

(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.

Official text — DPDP Rules, 2025, Rule 14(4)

(4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.