Is the DPDP Act fully in force right now?

The Act was passed in August 2023, and the DPDP Rules, 2025 set out the operational detail — consent managers, breach reporting, timelines. Key obligations commence in phases through 2026, so companies are building compliance now. The direction is settled even where a specific date isn't.

Can I really make a company delete my data?

Yes — Section 12 gives you the right to erasure, and Section 8 obliges the company to erase data once its purpose is served. The honest caveat: other laws can require retention for a period. A lender, for instance, must keep certain records under RBI and anti-money-laundering rules. Erasure applies to everything beyond what the law compels them to keep.

What if a company simply ignores my request?

Use its grievance channel under Section 13 first — it must respond within the prescribed period. If that fails, you can complain to the Data Protection Board of India, which can inquire and impose penalties. Keep a record of your request and its date; the sequence matters.

Does the Act cover foreign apps and websites?

It applies to digital personal data processed within India, and also to processing outside India when it is connected with offering goods or services to people in India. A shopping app headquartered abroad but selling to Indian customers is inside the Act's reach.

Data rights · 7 min read · 29 July 2026

The DPDP Act: what India's data law gives you

Most of us have signed away our data a hundred times without reading a word. A lending app wants your contacts, a shopping app wants your location, and the 'I agree' button is the only door into the service. The Digital Personal Data Protection Act, 2023 — the DPDP Act — is India's answer to that bargain. It is the country's first comprehensive data-protection law, and it quietly rewires the relationship between you and every app on your phone.

The Act calls you the Data Principal — the person the data is about — and calls the company a Data Fiduciary, a word borrowed from trust law on purpose. This guide walks through what the law actually gives you, section by section, in plain English: how consent must work, what companies owe you, and the rights you can start exercising with a single email.

The big idea: processing needs a lawful reason (Sections 4–7)

The spine of the Act sits in Sections 4 to 7. Section 4 says a company may process your personal data only for a lawful purpose, and only on one of two grounds: your consent, or a short list of 'legitimate uses'. There is no third door. If a fintech app wants to read your SMS inbox to build a credit score, it needs one of those two grounds — and for almost everything a consumer app does, that ground is consent.

Section 5 adds the notice: before asking for consent, the company must tell you, in clear language, what data it wants, why it wants it, how you can exercise your rights, and how to complain. Section 7 carves out the legitimate uses — a medical emergency, certain state functions, data you volunteered for a specified purpose — kept deliberately narrow so that consent stays the default.

Consent, properly defined (Section 6)

Section 6 is where the law grows teeth. Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the purpose stated. Each word does work. 'Specific' means a shopping app cannot bundle 'deliver my order' with 'profile me for ads' behind one tick-box. 'Unconditional' means a lending app cannot make an unrelated permission — access to your photo gallery, say — the price of a loan application.

Then comes the clause worth memorising: Section 6(4). Withdrawing consent must be as easy as giving it was. If you consented with one tap, withdrawal should take something close to one tap — not an email to support, a phone call, and a ten-day wait. Withdrawal doesn't undo processing already done lawfully, but from that moment the company must stop, and must make its processors stop too.

What every company owes you (Section 8)

Section 8 lists the obligations of the Data Fiduciary — duties that exist whether or not you ever ask. The company stays responsible even when the work happens elsewhere: if a shopping app hands your address to a delivery partner or a cloud vendor, it may engage that Data Processor only under a valid contract, and the legal responsibility remains with the app you dealt with. Among the duties:

Keep your data accurate and complete when it is used to make a decision about you or shared with another company.
Put reasonable security safeguards in place to prevent a breach.
If a breach happens, inform the Data Protection Board and the affected users.
Erase personal data once its purpose is served and no law requires keeping it.

Children online, and the biggest fiduciaries (Sections 9–10)

Section 9 draws a hard line around children. Before processing the personal data of anyone under eighteen, a company must obtain verifiable consent from a parent or lawful guardian. It must not track or behaviourally monitor children, and must not direct targeted advertising at them. For an industry built on engagement loops, this is one of the Act's most consequential lines.

Section 10 recognises that not all fiduciaries are equal. The Central Government can notify a company as a Significant Data Fiduciary — based on the volume and sensitivity of data it handles and the risk of harm — and attach heavier duties: a Data Protection Officer based in India, independent data audits, and periodic Data Protection Impact Assessments. Scale buys obligations, not exemptions.

Your rights, one by one (Sections 11–14)

Chapter III is the part you can actually use. Four rights, each with a section number worth knowing.

Access (Section 11): you can ask for a summary of the personal data a company holds on you, the processing it is carrying out, and the identities of everyone it has shared your data with. Ask a lending app which bureaus and partners received your file — it must answer.
Correction, completion, updating and erasure (Section 12): if the shopping app has your old address, you can have it corrected. If a lender's record of you is incomplete in a way that hurts you, you can have it completed and updated. And when the data is no longer needed — and no law requires keeping it — you can have it erased.
Grievance redressal (Section 13): every fiduciary must give you a readily available way to complain, and must respond within the prescribed period. This is also the gate — you must use the company's grievance channel first, before escalating to the Board.
Nomination (Section 14): you can nominate someone to exercise these rights for you if you die or become incapacitated, so your data-life doesn't become unreachable to the people handling your affairs.

Duties, the Board, and data leaving India (Sections 15–16)

The Act asks something of you too. Section 15 lists the duties of the Data Principal: don't impersonate anyone, don't suppress material information, don't file false or frivolous complaints, and give authentic information when you seek correction or erasure. The rights are real; so is the expectation that they are used honestly.

Section 16 handles data crossing borders. Rather than a whitelist, the Act lets the Central Government restrict transfers of personal data to countries it notifies — transfers are permitted by default unless a destination is put off-limits, and stricter sectoral rules, like the RBI's for payment data, continue to apply on top.

Enforcement sits with the Data Protection Board of India — a digital-first adjudicator that inquires into breaches, hears complaints once a company's own grievance channel has been exhausted, and can impose substantial monetary penalties, running at the top of the scale into hundreds of crores. The DPDP Rules, 2025 supply the operational machinery, and key obligations commence in phases through 2026 — which is why consent screens across your phone are quietly getting more honest.

Questions people ask

Is the DPDP Act fully in force right now?: The Act was passed in August 2023, and the DPDP Rules, 2025 set out the operational detail — consent managers, breach reporting, timelines. Key obligations commence in phases through 2026, so companies are building compliance now. The direction is settled even where a specific date isn't.
Can I really make a company delete my data?: Yes — Section 12 gives you the right to erasure, and Section 8 obliges the company to erase data once its purpose is served. The honest caveat: other laws can require retention for a period. A lender, for instance, must keep certain records under RBI and anti-money-laundering rules. Erasure applies to everything beyond what the law compels them to keep.
What if a company simply ignores my request?: Use its grievance channel under Section 13 first — it must respond within the prescribed period. If that fails, you can complain to the Data Protection Board of India, which can inquire and impose penalties. Keep a record of your request and its date; the sequence matters.
Does the Act cover foreign apps and websites?: It applies to digital personal data processed within India, and also to processing outside India when it is connected with offering goods or services to people in India. A shopping app headquartered abroad but selling to Indian customers is inside the Act's reach.

This article is educational and reflects our reading of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as they stand. It is not legal advice. For decisions that depend on the law, consult a qualified professional; provisions and timelines may change as commencement continues.