India's Data Protection Law Is Finally Live β 7 Privacy Rights You Should Start Using
For years, "data protection" in India was a promise on paper. That changed on 14 November 2025, when the government notified the Digital Personal Data Protection (DPDP) Rules, 2025 β operationalising the DPDP Act, 2023. Companies, apps and websites that process your personal data now have enforceable legal duties, being phased in through 2026 and 2027, with penalties running up to βΉ250 crore per violation.
Most Indians haven't noticed yet. Here's what the law actually gives you, and how to use it.
The 7 rights you now have
1. Consent must be real, specific and in plain language
Companies ("data fiduciaries" in the law) must ask for your consent through a clear notice β what data, for what purpose β available in English or any of the 22 scheduled Indian languages. Bundled, buried, take-it-or-leave-it consent is exactly what the law targets.
2. You can withdraw consent as easily as you gave it
Withdrawing consent must be as simple as granting it was. Once withdrawn, the company must stop processing and delete the data unless another law requires keeping it.
3. You can ask what a company holds about you
You have a right to a summary of the personal data being processed, the purposes, and every entity it has been shared with.
4. You can demand correction and erasure
Wrong phone number, stale address, an account you closed years ago β you can require correction, updating and erasure of data no longer needed for the purpose you consented to.
5. Grievances must be answered β on a clock
Every data fiduciary must publish a grievance officer contact and respond within defined timelines. If they don't, you can escalate to the Data Protection Board of India β the adjudicating body under the Act.
6. Children get special protection
Processing a child's data requires verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
7. You can nominate someone
You may nominate a person to exercise these rights for you in case of death or incapacity β a small clause with real consequences for digital inheritance.
What companies must now do
| Duty | What it means for you |
|---|---|
| Purpose limitation | Data collected for delivery can't quietly become marketing fodder |
| Breach notification | You must be informed of data breaches affecting you, without delay |
| Data minimisation and erasure | Companies can't hoard your data forever "just in case" |
| Security safeguards | Encryption, access control and logging are legal duties, not best practices |
| Consent managers | Registered platforms will let you view and manage consents in one place |
The honest caveats
- Phased rollout. Core obligations take effect in stages β some duties apply from late 2026 into 2027. Companies are adapting now; full enforcement builds over time.
- The Board is still being set up. As of mid-2026 the Data Protection Board is not yet fully operational, so escalation paths are still settling.
- Government exemptions are broad, and the Act's amendment to the RTI Act is under challenge β in February 2026 the Supreme Court issued notice in petitions questioning parts of the DPDP framework. The law will keep evolving.
Rights get real when people use them. Email a company's grievance officer requesting your data summary or erasure β even an ignored request builds the record that matters when the Board takes up complaints.
5 practical moves this week
- Audit app permissions (Settings β Privacy): revoke location, contacts, microphone and SMS access from apps that don't need them.
- Use "delete account", not just "uninstall" β under the DPDP regime, deletion requests now carry legal weight.
- Find the grievance officer page of your bank, telecom and most-used apps β bookmark them.
- Check what Google and Meta hold on you (Google Takeout, Meta's "Download your information") β informed consent starts with knowing.
- Lock your Aadhaar biometrics in the mAadhaar app, and share masked Aadhaar wherever full details aren't required.
The bottom line
India now has an enforceable privacy law with real penalties β but a law only protects people who invoke it. Learn the seven rights, use the grievance channels, and treat every consent screen as a decision rather than an obstacle. Your data has always been valuable; from November 2025, it finally has legal armour.
How this guide is made
Written and fact-checked by the Awareness360 editorial team from primary sources β RBI, SEBI, IRDAI, the Income Tax Department and Government of India portals β with links to the originals in the text above. Last reviewed on 28 Jun 2026. This is general educational information for Indian readers, not professional financial, legal or tax advice.
Spotted something out of date? Tell us and we'll correct it β see our editorial policy.