DPDP Rules: What Your Data Rights Mean One Year On

The DPDP Rules, the detailed framework behind India’s personal data law, were notified on 14 November 2025. As the first anniversary nears, many readers still ask what the rules actually give them. In short, you get clear rights over your data, a digital way to complain, and a 90 day deadline for companies to respond.

What the DPDP Rules give you

According to the Press Information Bureau’s explainer, you can allow or deny the use of your data and withdraw consent at any time. You can also ask what data a company collects, why it needs it, and how it uses it.

Beyond that, you can ask to access, correct, update or erase your personal data. You can also nominate another person to use these rights for you. For example, a family member could act if you cannot.

How to complain when a company does not respond

Companies that handle your data, called Data Fiduciaries, must answer access, correction and erasure requests within a maximum of 90 days. If they do not, the next step is the Data Protection Board. The Board works fully online, so you can file a complaint and track it through a portal and mobile app.

However, the Board’s decision is not always final. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal, better known as TDSAT.

Breach notices and children’s data

If your data leaks, the company must inform every affected person without delay. The notice should use plain language. It must explain what happened, the possible impact, the steps taken and whom to contact for help.

The rules also protect children. A parent or guardian must give verifiable consent before a company processes a child’s data. Essential services such as healthcare, education and real time safety are exceptions.

When companies must be ready

The government set an 18 month phased period so organisations can adjust their systems. Counted from notification, that points to around May 2027. Meanwhile, the penalty for failing to keep reasonable security safeguards can reach ₹250 crore.

So what should you do today? Start by reading privacy notices before you tap accept. Then withdraw consent from apps you no longer use, and keep a record of any request you send. Also, silence calls and messages you never asked for, as our guide to registering for DND explains.

FAQ

Can I ask a company to delete my data under the DPDP Rules?

Yes. Erasure is one of the rights the rules list, along with access, correction and update. The company must respond within a maximum of 90 days.

Where do I complain about a DPDP violation?

Start with the company’s grievance contact. If that fails, file a complaint with the Data Protection Board online. It runs through a portal and a mobile app.

Does the DPDP Rules framework protect children?

Yes. Companies need verifiable parental or guardian consent to process a child’s data, with exceptions for healthcare, education and real time safety.