The legal framework
The Digital Personal Data Protection Act 2023 was activated by the notification of the DPDP Rules on 14 November 2025. Implementation is phased: procedural provisions immediately, consent manager rules from November 2026, and the substantive compliance obligations from May 2027. The Act creates a Data Protection Board with power to impose penalties up to 250 crore rupees.
Key points
| Rights | Access, correction, erasure, grievance redress and nomination of a representative |
|---|---|
| Consent | Must be free, specific, informed and unambiguous, with clear notice |
| Consent managers | A distinctive Indian mechanism, registered with the Board |
| Children | Verifiable parental consent required under 18, with tracking and targeted advertising prohibited |
| Penalties | Up to 250 crore rupees per breach |
| Exemptions | Broad exemptions for government processing, the main criticism of the Act |
| Timeline | Substantive obligations from May 2027 |
| Penalties to the state | The Act provides penalties but no compensation to individuals |
| Duties of data principals | Individuals themselves have statutory duties, including not filing false complaints |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Use the grievance officer route first: the Act requires it before approaching the Board.
- For a personal remedy, consider a writ petition or a consumer complaint instead.
Cost and coverage
Free; complaints go to the Data Protection Board after exhausting the company's grievance process.
Recent changes
Because obligations are phased to 2027, many companies are not yet subject to the substantive duties — check which phase applies before complaining.
Where to go
- Data Protection Board of India, once operational.
- Grievance officers, whose details every significant service must publish.
- Internet Freedom Foundation for advocacy and guidance.
Worth knowing
The Act requires companies to publish a grievance officer's contact details, and you must use that route first. Screenshot the page: it is often hard to find later. The Act imposes duties on individuals as well as companies, including a penalty for frivolous complaints. That is unusual and worth knowing before filing.
Official sources and links
- India.gov.in — national portal of India
- India Code — central and state legislation