The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set out how organisations (called Data Fiduciaries) may process your personal data, and the rights you have as a Data Principal.
Consent must be meaningful
Consent must be free, specific, informed and unambiguous, given by a clear action — not a pre-ticked box — and limited to the stated purpose. You can withdraw consent at any time, and withdrawing must be as easy as giving it.
Your rights
- Access — a summary of your personal data being processed and the identities of others it was shared with (s.11).
- Correction and erasure — to correct, complete, update or erase your data (s.12).
- Grievance redressal — a response from the organisation to your complaint (s.13).
- Nomination — to nominate someone to exercise your rights in case of death or incapacity (s.14).
If something goes wrong
Organisations must protect your data with reasonable safeguards and inform you and the Data Protection Board of India of a personal data breach. If your grievance is not resolved, you may approach the Board.
Your duties
You must not provide false information, impersonate others or file frivolous complaints (s.15).
You can see how this website handles your data in our privacy policy, and exercise your rights on the data rights page.
