How to Exercise Your Data Privacy Rights Under India's DPDP Rules 2026
• The Legal Basis: Digital Personal Data Protection (DPDP) Act 2023 and the operational Rules notified in late 2025/early 2026.
• The Data Principal: You (the citizen/user) whose personal data is being processed.
• The Data Fiduciary: The entity (app, bank, or government body) that determines the purpose of processing your data.
• Key Rights: The right to access, correct, complete, or request erasure of your personal data.
• Enforcement: The Data Protection Board of India (DPBI) acts as the adjudicatory body for grievances.
With the notification of the Digital Personal Data Protection Rules in 2026, India has transitioned from a voluntary data privacy regime to a strictly enforceable framework. As a 'Data Principal,' you now hold statutory rights over your personal data that carry significant legal weight. This guide explains how to navigate the technical and legal requirements to reclaim control over your digital footprint.
Implementation Steps
1. Identify the Data Fiduciary’s Point of Contact
Under the DPDP Rules, every significant data fiduciary (large platforms or sensitive entities) is required to publish the contact details of a Data Protection Officer (DPO) or a dedicated grievance officer. Locate this in the 'Privacy Policy' or 'Terms of Service' section of the platform you wish to query.
2. Submit a formal 'Request for Access'
You have the right to know what personal data is being processed and why. Submit a written request (via the mandated email or portal) asking for a summary of your data, the processing activities carried out, and the identities of any third parties with whom your data has been shared. Legal Note: Companies must provide this in a clear and accessible format.
3. Exercise the Right to Correction or Erasure
If you find that your data is inaccurate or incomplete, you can formally request its correction or completion. If you wish to withdraw consent for a service you no longer use, you can request 'Erasure.' Technical Context: Fiduciaries must ensure that the erasure request propagates to any third-party processors they have shared your data with.
4. Monitor the 90-Day Response Window
The DPDP Rules mandate that a Data Fiduciary must respond to your request or resolve your grievance within a maximum of 90 days. Keep a record of your submission date and all subsequent correspondence.
5. Escalate to the Data Protection Board (DPBI)
If the entity fails to respond within 90 days, or if the response is unsatisfactory, you can file a formal complaint with the Data Protection Board of India. The DPBI has the authority to investigate and impose heavy penalties (up to ₹250 crore) on fiduciaries that fail to protect your rights.
Comments ()