Your data, your rights

India's data protection law

The Digital Personal Data Protection Act, 2023 sets rules for apps, banks, hospitals, shops, schools, employers and government bodies that hold your data in digital form.

The Act received the President's assent on 11 August 2023. The DPDP Rules, 2025, notified on 13 November 2025, add the practical detail. The Act's opening words say it recognises both your right to protect your personal data and the need to process it for lawful purposes. This is a simplified guide, not legal advice.

Key definition

If a piece of information is about you and can be linked to you, it is personal data. The law protects it when it is in digital form.

Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to that data. The Act covers digital personal data, including data collected on paper and digitised later (s.3(a)). The Act does not create a separate category of 'sensitive' data; the same rules apply to every kind.

Who is who

The law uses a few special terms. You are the Data Principal. The organisation that decides why and how your data is used is the Data Fiduciary.

The organisation stays responsible even when a vendor does the work for it (s.8(1)), so your requests and complaints go to the organisation, not to its vendors. For a child, 'Data Principal' includes the parents or lawful guardian, and for a person with disability it includes her lawful guardian (s.2(j)). A Significant Data Fiduciary must appoint a Data Protection Officer based in India, who is the contact point for grievances (s.10(2)).

What the law covers

The law covers personal data in digital form. It does not cover what an individual does for personal or home use, or data that you have made public yourself.

The Act's own example: a person who blogs her views and makes her personal data public on social media is not protected by the Act for that data (s.3(c), Illustration). So think before you post personal details publicly. A friend saving your number on her phone is personal use and is also outside the Act (s.3(c)(i)).

When your protections begin

Most protections are not in force yet. The duties on organisations, and your rights against them, begin in May 2027.

Rule 1 brings Rules 1, 2 and 17 to 21 into force on publication, Rule 4 one year later, and Rules 3, 5 to 16, 22 and 23 eighteen months later. The sections of the Act are brought into force by Government notification (s.1(2)). Until May 2027 you cannot yet use the rights described in this track. In January 2026 the Ministry proposed shortening the timeline to 12 months; as of November 2026 no amendment has been notified.

Your rights at a glance

From May 2027 you will have these rights. The next four chapters explain each one, and how to use it.

Notice is in s.5, consent and withdrawal in s.6, breach intimation in s.8(6), access in s.11, correction and erasure in s.12, grievance redressal in s.13 and nomination in s.14. The rights of access, correction and erasure apply where the organisation processes your data on the basis of your consent, or data you gave it voluntarily (s.11(1), s.12(1)).

Know the limits

This law does not protect you in every situation. Many rights do not apply to the investigation of offences, to courts and regulators, or to government agencies that are exempted.

The Act does not apply at all to State bodies the Central Government notifies in the interests of sovereignty, security of the State, friendly relations with foreign States or public order (s.17(2)(a)). Most duties and all the rights in Chapter III do not apply to processing for preventing or investigating offences, for courts and regulators doing their functions, or for enforcing a legal claim (s.17(1)). Government bodies need not erase your data on request (s.17(4)). Penalties go to the Consolidated Fund of India (s.34), and the Act has no provision for compensation.

In one line

That is the overview. Next, what you are really agreeing to when you tap 'I agree'.