What the Digital Personal Data Protection Act, 2023 gives you as a person whose data is collected. General legal information only. Check the commencement dates, as the Act is being brought into force in phases.
Your rights as a Data Principal
- Information: to get a summary of the personal data processed and the processing activities.
- Correction and erasure: to ask for inaccurate data to be corrected and for data to be erased when it is no longer needed.
- Grievance redressal: to have a grievance handled by the organisation’s grievance officer.
- Nomination: to nominate someone to exercise your rights in case of death or incapacity.
Consent
Consent should be free, specific, informed and clear, and you should be able to withdraw it as easily as it was given. Organisations must give a notice, in plain language, about what data they collect and why.
Your own duties
The Act also places duties on individuals, such as not filing false or frivolous complaints and not impersonating another person.
If things go wrong
- Raise a complaint with the organisation first.
- If it is not resolved, you can approach the Data Protection Board of India once it is functioning, as the Act and Rules provide.
Related: Data protection (DPDP) · All data protection guides · Send an enquiry
Important disclaimer: This article is general legal information, not legal advice. It does not create a lawyer-client relationship and is not an advertisement or solicitation under Bar Council of India rules. Verify current statutes, rules and judgments before relying on it.
