Access, correction and erasure

Your right to access

You can ask an organisation for a summary of your personal data that it is processing, and for the identities of everyone it shared that data with.

Section 11(1)(a) covers the summary of your data and the processing activities. Section 11(1)(b) covers the identities of all other Data Fiduciaries and Data Processors the data was shared with, and a description of what was shared. Section 11(1)(c) allows the Rules to add further information; the 2025 Rules do not list any.

The limits of the access right

The access right applies where you gave consent, or gave your data voluntarily. It gives you a summary, and it has exceptions.

Section 11(1) gives the right against a Data Fiduciary 'to whom she has previously given consent', including data given voluntarily under s.7(a). So where an employer relies on s.7(i), or a government body on s.7(b) or (c), this Act does not give you the access right. Sharing with a body authorised by law, on its written request, to prevent or investigate offences or cyber incidents need not be disclosed (s.11(2)). The Government may also exempt notified organisations, including startups, from s.11 (s.17(3)).

Fixing and deleting your data

You can ask for your data to be corrected, completed, updated or erased. When you ask, you must give information that is verifiably authentic.

On a request, the organisation must correct, complete or update the data (s.12(2)). Like access, these rights apply to data processed with your consent or given voluntarily (s.12(1)). Your duty to give only verifiably authentic information is in s.15(e). Separately, an organisation must keep data complete and accurate when it is likely to be used for a decision that affects you, or disclosed to another organisation (s.8(3)).

Erasure has limits

Erasure is not absolute. Data needed for the purpose you agreed to, or that a law requires to be kept, stays. Government bodies are not bound by the erasure duty.

Section 12(3) requires erasure unless retention is necessary for the specified purpose or for compliance with any law. The bank example is Illustration II to s.8(7). For processing by the State, s.8(7) and s.12(3) do not apply, and the correction duty in s.12(2) does not apply where the processing does not involve a decision that affects you (s.17(4)).

How to make a request

Each organisation must publish how to make a request, and what identifier it needs from you. If you get no proper answer, raise a grievance with the organisation.

Rule 14(1) requires the organisation to publish prominently, on its website or app, the means of making a request and the identifier it needs, such as a username, customer ID, enrolment ID, email address or mobile number (Rule 14(5)). It must also publish contact details of a person who can answer your questions (Rule 9). Rule 14 gives no fixed period for answering an access, correction or erasure request; the 90-day outer limit in Rule 14(3) is for grievances. The Act and Rules do not mention any fee for a request.

Large platforms must delete idle data

For very large e-commerce, gaming and social media platforms, the Rules fix a time limit. If you are inactive for three years, they must erase your data.

The three years run from when you last approached the platform for the purpose or used your rights, or from the start of the Rules, whichever is latest (Third Schedule). Data needed to let you access your user account, or a virtual token you can use to get money, goods or services, is outside this rule, as is data a law requires to be kept. For every other organisation there is no fixed number: data must be erased once it is reasonable to assume the purpose is no longer served (s.8(7)).

The three-year inactivity rule

At least 48 hours before erasing, the platform must warn you. If you log in, contact it for the service, or use your rights, your data is not erased.

Rule 8(2) requires the platform to inform you at least forty-eight hours before the period ends that your data will be erased unless you log in to your user account, otherwise contact it for the purpose, or exercise your rights. The Rules do not say how the warning must be sent, so keep your email address and mobile number with the platform up to date.

1 year minimum time data and logs are kept

There is also a minimum. Organisations must keep personal data and logs of processing for at least one year, so erasure on request is not always immediate.

Rule 8(3) requires this retention for the purposes in the Seventh Schedule, which are uses by the State such as security of the State and functions under law. The Rule's example is an e-book platform that must keep order details and logs for at least one year even if the buyer deletes her account. After one year the data and logs must be erased unless another law or the Government requires them to be kept longer.

In one line

Next: the extra protection for children, and how someone else can act for you.