India's Data Protection Law Explained: What Changes for You
India's DPDP Rules are being phased in. Learn your new rights over your personal data, what companies must now do, and the dates to watch, in plain language.
Every app you use collects something about you: your name, phone number, location, or what you buy. India's Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, notified in November 2025, set the first full legal framework on how companies and organisations may handle your digital personal data. The rules are being switched on in stages over about 18 months, so some parts are already in place and others are still coming.
The key terms, simply
- Data Principal: you, the person the data is about.
- Data Fiduciary: the company or organisation that decides why and how your data is used, such as an app, a bank, or an online shop.
- Consent Manager: a registered service that helps you give, review, and withdraw your permissions in one place.
What the law asks companies to do
- Ask for your consent in a clear, plain-language notice that explains exactly what data is taken and why.
- Collect only the data needed for the stated purpose.
- Protect the data with reasonable security safeguards and tell affected people and the regulator if there is a breach.
- Get verifiable consent from a parent or guardian before using the data of a child. A lawful guardian must consent for a person with a disability who cannot make legal decisions even with support.
Your rights as a Data Principal
Know what is collected
Ask for a summary of the personal data a company holds about you and how it is used.
Correct or update it
Ask the company to fix wrong or outdated details.
Ask for deletion
Request erasure of data that is no longer needed for its purpose.
Withdraw consent
You can take back permission, and it should be as easy as giving it.
Complain
Take your complaint to the company first. Companies have a limited time to respond, up to 90 days under the rules. If you are not satisfied, you can approach the Data Protection Board of India.
Nominate someone
Choose a person to exercise your rights if you die or cannot do so yourself.
The timeline
The rules came into force in stages. The Data Protection Board's setup began at once. Rules for Consent Managers follow after about 12 months of notification, around November 2026. The main duties for companies, such as notices, consent, and breach reporting, apply after about 18 months, around May 2027. Until then, the older IT Act rules on personal data stay in force.
What most people miss
- It covers digital data, and paper records only if they are later digitised.
- Penalties are heavy. The Act allows fines of up to ₹250 crore for serious failures such as not keeping data secure.
- The government has exemptions for certain purposes, such as national security, which are part of the debate around the law.
- You still need good habits. Use strong passwords, share only what is needed, and read permission screens on new apps.
