It provides rights and ways to seek information about their personal data, request corrections or erasure where applicable, and raise grievances.
INDIA
भारत
·
DIGITAL PERSONAL DATA PROTECTION
What does DPDPA
mean for me?
A framework for how organisations collect, use, store and manage digital personal data — and the rights individuals have over that information.
Know Your Rights
as a Data Principal
Your personal data matters. Do you know the rights you have under India’s Digital Personal Data Protection Act (DPDPA), 2023?
This video explains the five Data Principal Rights, the responsibilities associated with exercising them, and how individuals can raise requests concerning their personal data with organizations.
Understanding these rights can help you make informed decisions about your personal information and take an active role in protecting it.
Explore All Rights OVERVIEW
Protecting personal data
in
everyday digital life.
Every day, we share personal information when using websites, mobile apps, online shopping platforms, banking services, educational portals, and other digital services. This information helps organizations deliver services, but it also needs to be handled responsibly.
Mera Data, Mera Niyantran, Mera Samman
— My Data, My Control, My Respect
India's Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for protecting digital personal data and defining how organizations should collect, use, store, and manage it.
The DPDP Act, together with the Digital Personal Data Protection Rules, 2025, sets out responsibilities for organizations and rights for individuals. The framework aims to encourage transparent data practices, responsible use of personal information, and greater trust between individuals and organizations.
Why does DPDPA matter?
It establishes responsibilities for handling personal data, communicating clearly about its use, maintaining appropriate safeguards, and responding to individuals' requests.
It encourages organizations to treat personal data responsibly and build trust in digital services.
DPDPA is not only about meeting regulatory requirements. It is also about creating a digital environment where personal information is handled with care, transparency, and accountability.
BHARAT PRIVACY YATRA 2026
Bharat Privacy Yatra 2026
Mera Data,
Mera Niyantran, Mera Samman
Taking privacy awareness across India
0
Cities Covered
0+
Kilometers
0
Days
A nationwide privacy-awareness initiative led by Ardent Privacy — from Pune to Mumbai — to make DPDPA and responsible data use more accessible.
DATA PRINCIPALS
What does DPDPA
mean for
me?
Have you ever wondered why an app asks for your phone number, how a company uses your email address, or what happens to your personal information after you stop using a service?
DPDPA helps you understand your role in protecting your personal data and gives you specific rights when organizations process your digital personal information.
Under the framework, you are known as a Data Principal when the personal data relates to you.
Your personal data may include your name, phone number, email address, identification details, or other information that can identify you.
What should you know as a Data Principal?
-
Understand why your data is collectedLook for clear information explaining what personal data an organization wants to collect and why it needs that information.
-
Know how your data is usedUnderstand the purpose for which your information is being processed and review the information provided by the organization before making a decision.
-
Manage your consentWhere processing is based on consent, you can withdraw your consent. However, withdrawing consent does not automatically erase every record or end every form of processing; legal requirements and other applicable grounds may affect what happens next.
-
Know where to raise a concernIf you have a question or concern about how an organization handles your personal data, look for its designated contact or grievance redressal channel.
-
Take an active role in your privacyRead privacy notices, share only the information needed for a service, use available privacy settings, and be cautious about sharing personal information with unfamiliar websites or apps.
Your personal data matters. Understanding your rights is the first step towards taking greater control of how it is handled.
DATA FIDUCIARIES
DPDPA for organizations:
What
does your business need to know?
Organizations collect and process personal data every day, whether through customer registrations, employee records, websites, mobile applications, marketing campaigns, or business operations.
Under the DPDP framework, an organization that determines the purpose and means of processing personal data is generally known as a Data Fiduciary.
If your organization collects or uses digital personal data, understanding DPDPA is an important step towards establishing responsible data practices and preparing for applicable compliance requirements.
What should organizations focus on?
-
1. Understand what personal data you collectIdentify the personal data your organization collects, where it is stored, how it flows across systems, and which teams or service providers can access it.
-
2. Be clear about the purpose of data collectionExplain why personal data is being collected and how it will be used. Provide clear, accessible notices and obtain valid consent where required, subject to applicable provisions and exceptions.
-
3. Establish consent management processesWhere consent is the basis for processing, establish appropriate processes to record consent, manage changes, and act on withdrawal requests.
-
4. Protect personal dataImplement appropriate technical and organizational security measures to protect personal data against unauthorized access, disclosure, loss, and other security risks.
-
5. Enable Data Principal rightsEstablish accessible processes for handling requests relating to personal data, including correction, updating, erasure where applicable, and grievance redressal.
-
6. Prepare for personal data breachesDevelop procedures to identify, assess, manage, and respond to personal data breaches, including applicable notification requirements.
-
7. Review third-party data processingUnderstand how vendors, service providers, and other partners process personal data on your organization's behalf, and establish appropriate contractual and operational controls.
-
8. Build ongoing privacy governanceAssign responsibilities, maintain relevant records, review privacy practices periodically, and establish processes to monitor compliance as requirements evolve.
Why should organizations take action?
A structured approach to DPDPA can help organizations improve visibility into personal data, strengthen internal processes, respond to individuals more effectively, and build trust with customers, employees, and business partners.
Start by understanding your data. Build the processes needed to manage it responsibly.
YOUR RIGHTS
How does DPDPA help
protect your
personal data?
Your personal information is part of your everyday digital life. From opening a bank account to ordering products online, you regularly share information with organizations.
DPDPA establishes a framework that helps you understand how your personal data should be handled and what you can do when you want information, a correction, or assistance from an organization.
Understand your rights as a Data Principal
You can request information about your personal data being processed and certain details about how it is handled, subject to applicable conditions.
If your personal information is inaccurate or incomplete, you can request correction, completion, or updating, as applicable.
You can request erasure of personal data where the framework provides for it. An organization may need to retain certain information where required by law or otherwise permitted under applicable provisions.
When your personal data is processed based on consent, you can withdraw that consent. The organization must handle the withdrawal in accordance with applicable requirements.
If you have a concern about the handling of your personal data or the exercise of your rights, you can use the organization's grievance redressal mechanism and follow the applicable escalation process.
The framework provides for nominating another individual to exercise your rights in the event of your death or incapacity, in accordance with applicable requirements.
How can you exercise your rights?
- Identify the organization that holds or processes your personal data.
- Visit its website or app and look for its privacy notice, designated contact, or grievance redressal information.
- Submit your request through the specified channel and provide the information needed to verify your identity.
- Keep a copy of your request and any acknowledgement or response.
- If your concern remains unresolved, review the applicable grievance escalation process.
Remember: Your rights are supported by defined processes and applicable conditions. Understanding how to use those processes can help you take a more active role in protecting your personal information.