What rights do I have over my personal data under the new DPDPA?

What the Law Says

The Digital Personal Data Protection Act, 2023 (DPDPA) grants individuals — called 'Data Principals' — enforceable rights over their personal data collected by 'Data Fiduciaries'. These rights are designed to ensure transparency, accountability, and control.

As a Data Principal, you can ask a Data Fiduciary (e.g., an app, bank, or e-commerce platform) for confirmation of whether your data is being processed, a summary of what data is held, and why it’s being used.

You may request correction or completion of inaccurate or incomplete personal data. The Data Fiduciary must respond within 30 days.

You also have the right to request erasure of your personal data — unless retention is required by law or necessary for a legal claim.

If you believe your rights have been violated, you can file a grievance with the Data Fiduciary first; if unresolved, escalate to the Data Protection Board of India.

Where technically feasible and subject to applicable laws, you may also request transfer of your data to another Data Fiduciary — this is the right to data portability.

Statutory Text

Every Data Principal shall have the right to obtain from the Data Fiduciary confirmation as to whether any personal data concerning such Data Principal is being processed and where such personal data is being processed, a summary of such personal data and the processing activities undertaken.

— Digital Personal Data Protection Act, 2023, s. 11(1) — Rights of Data Principal

Statutory Text

Every Data Principal shall have the right to seek correction and erasure of his personal data which is inaccurate, incomplete, out-of-date, or no longer necessary for the purpose for which it was collected.

— Digital Personal Data Protection Act, 2023, s. 11(2) — Rights of Data Principal

Statutory Text

Every Data Principal shall have the right to grievance redressal, including the right to file a complaint before the Board in accordance with the provisions of this Act.

— Digital Personal Data Protection Act, 2023, s. 11(6) — Rights of Data Principal

Statutory Text

Where such transfer is technically feasible and does not adversely affect the rights of any other Data Principal, the Data Fiduciary shall, on the request of the Data Principal, provide such personal data in a structured, commonly used and machine-readable format.

— Digital Personal Data Protection Act, 2023, s. 11(7) — Rights of Data Principal

Sources