Data Privacy Rights Under the DPDP Act 2023 Explained

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive law governing how your personal data may be collected, processed and used by organisations. If a company, app, website or government body collects your name, phone number, email, location or any other information that can identify you, the DPDP Act gives you the right to know, to correct, and in many cases to erase that data. The Act received Presidential assent on 11 August 2023 and applies to digital personal data processed within India, as well as data processed outside India when it relates to offering goods or services to persons in India.

As a Data Principal (the individual whose data is collected), you have legally enforceable rights under the DPDP Act. These include the right to access information about your data, the right to correction and erasure, the right to withdraw consent, and the right to grieve against a Data Fiduciary before the Data Protection Board of India. No fee is prescribed for lodging a complaint before the Board as of the date of writing; however, the Rules under the Act — which will set out the exact procedure — are still being finalised by the Ministry of Electronics and Information Technology (MeitY). For cyber-crime related data breaches, complaints can be filed at the National Cyber Crime Reporting Portal at no cost.

What Is the DPDP Act and Why Does It Matter?

Before the DPDP Act, India had no standalone data-protection statute. Privacy protections were scattered across Section 43A of the Information Technology Act, 2000 (read with the IT (Reasonable Security Practices) Rules, 2011), the Indian Contract Act, 1872 for contractual confidentiality, and the constitutional right to privacy recognised by the Supreme Court in K.S. Puttaswamy v. Union of India (2017). The DPDP Act consolidates these into a single framework modelled partly on global standards, while retaining India-specific carve-outs for national security and children's data.

The Act is built around two key actors: the Data Principal (you, the individual) and the Data Fiduciary (any person or entity that determines the purpose and means of processing your data — a bank, an e-commerce platform, a hospital, or even a government department). A third layer, the Data Processor, processes data on behalf of a Fiduciary and is bound by contractual obligations flowing from the Fiduciary's duties. Understanding this three-way relationship is essential before asserting your rights. For a broader overview of digital rights in India, the Digital Rights, Cyber Risks and Legal Awareness resource covers related topics in accessible detail.

What Personal Data Is Protected?

Under Section 2(t) of the DPDP Act, 'personal data' means any data about an individual who is identifiable by or in relation to such data. This is deliberately broad and includes your name, address, phone number, email, biometric information, financial details, health records, location data, device identifiers and social media profile information. The Act does not protect anonymised data — data that has been irreversibly stripped of all identifying information falls outside its scope.

• Sensitive personal data — The Act does not create a separate 'sensitive' category in the same way as the older IT Rules, but the Rules yet to be notified may impose higher obligations for certain categories.
• Children's data — Section 9 imposes a strict consent requirement: a Data Fiduciary must obtain verifiable parental consent before processing any data of a child (below 18 years). Processing that harms children or tracks them behaviourally is prohibited.
• Cross-border data — Section 16 empowers the Central Government to restrict transfer of personal data to specified countries. Until a negative list is notified, transfers are generally permitted.

What Are Your Rights as a Data Principal?

Chapter III of the DPDP Act confers the following rights on every Data Principal:

• Right to access information (Section 11): You can request a summary of your personal data being processed and the identities of all Data Fiduciaries and Data Processors handling it.
• Right to correction, completion and erasure (Section 12): You may demand correction of inaccurate data, completion of incomplete data, and erasure of data no longer necessary for the purpose for which consent was given.
• Right to grievance redressal (Section 13): Every Data Fiduciary must provide an accessible grievance mechanism. If you are unsatisfied, you may escalate to the Data Protection Board of India.
• Right to nominate (Section 14): You may nominate another individual to exercise your rights in the event of your death or incapacity — a significant new provision absent from earlier frameworks.
• Right to withdraw consent (Section 6(4)): Consent, once given, can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing done before withdrawal, but the Fiduciary must cease further processing.

What Are the Duties of a Data Fiduciary?

The obligations placed on Data Fiduciaries are the mirror image of your rights. Key duties include:

• Consent Notice (Section 5): Before collecting data, the Fiduciary must give a clear, plain-language notice in English or any scheduled language specifying what data is sought, the purpose and how you can withdraw consent.
• Purpose limitation: Data may only be used for the purpose disclosed at the time of collection.
• Data minimisation: Only data that is necessary for the stated purpose may be collected.
• Storage limitation: Data must be deleted once the purpose is served or consent is withdrawn, unless retention is required by law.
• Data breach notification (Section 8(6)): In the event of a personal data breach, the Fiduciary must notify both the Data Protection Board and affected Data Principals in the manner prescribed by the Rules.
• Significant Data Fiduciaries (Section 10): Entities designated as 'Significant' by the Central Government face additional obligations including appointing a Data Protection Officer, conducting periodic Data Protection Impact Assessments, and independent audits.

You can read the exact text of these provisions on the Digital Personal Data Protection Act 2023 bare act for detailed reference.

What Is the Data Protection Board of India?

The Data Protection Board of India (DPBI), established under Chapter V of the Act, is the adjudicatory body for DPDP Act complaints. It is an independent body with quasi-judicial powers. The Board will operate digitally — complaints must be filed through its online portal, which is expected to be launched once the Rules are notified by MeitY. The Board can:

• Inquire into complaints by Data Principals against Data Fiduciaries.
• Issue directions to Data Fiduciaries to comply with the Act.
• Impose financial penalties for contraventions.

Appeals from Board orders lie before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) under Section 29, and thereafter to the High Court.

What Penalties Apply for Violations?

Schedule I of the DPDP Act sets out a tiered penalty structure. These are the maximum penalties; actual amounts will be determined by the Board based on the nature and gravity of the breach:

• Failure to implement reasonable security safeguards leading to a data breach: up to ₹250 crore.
• Failure to notify the Board and Data Principals of a breach: up to ₹200 crore.
• Non-fulfilment of obligations related to children's data: up to ₹200 crore.
• Failure to comply with a Board order: up to ₹50 crore.
• Any other contravention: up to ₹50 crore.

Note that these penalties are imposed on Data Fiduciaries, not on individuals. The Act does not currently criminalise most contraventions — remedies are civil and financial in nature.

How Do You Exercise Your Rights? A Step-by-Step Overview

Until the DPBI's complaint portal is live, here is the process Data Principals should follow to assert their rights:

1. Step 1 — Identify the Fiduciary: Find the Data Fiduciary's name, registered address and privacy policy. Most apps and websites display this in their 'Privacy Policy' or 'Terms of Service' section.
2. Step 2 — Use the Fiduciary's grievance mechanism: Section 13 requires every Fiduciary to provide a grievance officer's contact. Submit a written request specifying the right you wish to exercise (access, correction, erasure or withdrawal of consent). Keep a copy of your request and any acknowledgment.
3. Step 3 — Await response: Although the Rules will specify exact timelines, as a general principle the Fiduciary should respond within a reasonable time. If you receive no response or an unsatisfactory response, proceed to the next step.
4. Step 4 — Approach the Data Protection Board: Once the DPBI's digital portal is operational (details to be announced by MeitY), file a complaint online. The Board is designed to be accessible without engaging a lawyer, though legal representation is permitted.
5. Step 5 — Parallel remedies for cyber crime: If the data violation involves a cyber crime (such as unauthorised access, data theft or identity fraud), file a complaint at the National Cyber Crime Reporting Portal simultaneously. This does not replace the DPBI process but can trigger criminal investigation.
6. Step 6 — Public grievance escalation: For complaints against government departments, you may also raise a grievance on the Centralised Public Grievance Redress portal.

Common Mistakes to Avoid When Asserting Data Rights

• Not keeping records: Always document your consent given to an app or service. Screenshots of consent notices and requests sent to Fiduciaries are essential evidence before the Board.
• Confusing DPDP with IT Act remedies: Section 43A of the IT Act, 2000 and the associated civil remedy before civil courts still co-exist with the DPDP Act regime, at least until the Rules clarify the repeal or continuation of those provisions.
• Expecting immediate erasure: Withdrawal of consent does not require the Fiduciary to erase data if another lawful basis (such as a statutory obligation) exists. Know the limits of each right.
• Missing the grievance officer step: The DPBI is unlikely to entertain a complaint unless you first approached the Fiduciary's grievance officer. Always exhaust this first-level remedy.
• Assuming the Act is fully operational: As of the date of this guide, the DPDP Act has received Presidential assent but the subordinate Rules are pending. Core rights exist in the statute, but procedural machinery — including the Board's portal — awaits the Rules.

When Should You Consult a Cyber Law Advocate?

The DPDP Act is designed to allow individuals to approach the Board without a lawyer, but legal guidance becomes important when: the breach involves large-scale identity theft or financial loss; you are dealing with a Significant Data Fiduciary that has legal teams; you need to pursue parallel remedies under the IT Act, the Indian Penal Code (or Bharatiya Nyaya Sanhita, 2023), or consumer law; or you wish to appeal a Board order before TDSAT. You can search for qualified advocates practising in cyber law on the LegalFirms.in advocate directory, or explore questions and answers on cyber law to understand how similar situations have been addressed. The guide on how to report cyber crime in India is also a useful companion resource if your data breach has a criminal dimension.

How Does the DPDP Act Compare With Earlier Law?

The DPDP Act replaces the data-protection provisions of the IT (Amendment) Act, 2008 and effectively supersedes the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they overlap. Unlike those Rules — which applied only to 'body corporates' and only to sensitive personal data — the DPDP Act applies to all Data Fiduciaries (including individuals acting in a professional capacity), covers all personal data processed digitally, and creates a dedicated regulatory body. If you want to compare legal texts, the Section 4 of the DPDP Act, which sets out the grounds for lawful processing, is a good starting point. You can also browse all legal guides on LegalFirms.in for related topics in cyber and consumer law.

This guide is general legal information, not legal advice. Laws and procedures may vary by state and change over time. Consult a qualified advocate for advice specific to your situation.

Step-by-Step Process