Skip to main content

Sources last verified on 17 August 2026. Methodology

Your DPDP rights, explained in plain language

Rights

By dpdprules.org editorial team · Reviewed by dpdprules.org source verificationPublished · Last reviewed

The short answer

Four rights: access to a summary of your personal data, its processing and who it was shared with, and correction, completion, updating and erasure, both exercised against the Data Fiduciary you previously gave consent to; readily available grievance redressal against the Data Fiduciary or Consent Manager concerned, with a published response period capped at ninety days, to be exhausted before approaching the Board; and nomination of another individual to exercise your rights on your death or incapacity. The Act pairs these with duties, including not impersonating anyone and not filing false or frivolous complaints.

The framework is usually discussed from the company's side. Here is what it gives you.

See what they hold and who they gave it to

Section 11 lets you obtain, from a Data Fiduciary you gave consent to, a summary of your personal data and the processing activities, plus the identities of every other Data Fiduciary and Data Processor it shared your data with, along with a description of what was shared. Sharing with authorities for offence prevention and similar purposes sits outside the sharing disclosure.

Fix it or erase it

Section 12 covers correction of inaccurate or misleading data, completion, updating, and erasure. Erasure has two named limits:

Official requirement · verbatim

"the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force"

A bank keeping records a banking law requires is the classic example of the second limit.

Complain, in the right order

Section 13 gives you readily available grievance redressal with the organisation, and requires exhausting it before approaching the Data Protection Board. The published response period is capped at ninety days under the Rules.

Name someone you trust

Section 14 lets you nominate another individual to exercise your rights if you die or become incapable due to unsoundness of mind or infirmity of body; the Rules let you nominate one or more individuals through the organisation's flow. It is the framework's most distinctive right and worth actually using once organisations expose it.

The duties that come along

Section 15 pairs the rights with duties: comply with applicable laws while exercising rights under the Act, do not impersonate anyone, do not suppress material information when providing personal data for State issued documents or identifiers, do not file false or frivolous grievances, and give only verifiably authentic information when seeking correction or erasure.

What to do

Pick your situation in the rights assistant; it gives the steps and the exact provisions for each pathway.

The individuals section

Sources cited on this page

  1. [1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 11, p. 9. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
  2. [2]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 12, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
  3. [3]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 13, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
  4. [4]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 14, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
  5. [5]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 15, p. 10. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026
  6. [6]Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 14, (3), p. 30. Published 13 November 2025. Official source ↗ · Official requirement · Verified 17 August 2026

rightsindividualsaccesserasure