Every app you install asks for something: your phone number, contacts, location, ID. Indian law has been patchy on whether you can say no, take consent back or demand deletion. The Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 change that, in stages. This guide has the DPDP act rules explained in plain English: what you can ask for, what apps must tell you, and what waits until May 2027. It matters more as AI tools and loan apps collect more of our data. We checked each point against the official Act and Rules.
The DPDP Act and Rules in Plain English
The Act is the law, passed on 11 August 2023. The Rules are the instruction manual, published in the Gazette dated 13 November 2025. They cover what a consent notice must say, how breaches are reported and how the Data Protection Board works. Key terms:
- Data Principal: you. For a child or a person with a disability, this includes the parent or lawful guardian.
- Data Fiduciary: any company, app or government body that decides why and how your data is used.
DPDP act rules explained in one minute
Organisations must ask before using your data, say what for, protect it, report breaches and delete data when the purpose ends. You can withdraw consent, see, correct and erase your data, and complain. The law covers digital personal data handled in India, and abroad when a service is offered to people in India (Section 3). It excludes purely personal or domestic use, and data you made public yourself.
Your Rights Under the DPDP Act: A Practical Checklist
Your rights under the DPDP Act, in short:
- A clear notice before you consent, in English or any language in the Constitution’s Eighth Schedule (Section 5).
- Withdraw consent at any time, as easily as you gave it (Section 6(4)).
- Access information: a summary of your data and its processing, and who it was shared with (Section 11).
- Correct, complete and update your data (Section 12).
- Erase data you consented to share (Section 12(3)).
- Grievance redressal, with a reply within the period the company publishes, never more than 90 days (Section 13, Rule 14).
- Nominate someone to act if you die or cannot act (Section 14). Rule 14(4) also lets you nominate people to exercise your rights.
- Complain to the Board once the company’s grievance route has failed (Sections 13(3), 27).
You have duties too, such as no impersonation and no false or frivolous complaints. Breaking them can cost up to ₹10,000 (Section 15 and the Schedule).
When these rights do not apply
- Legitimate uses need no consent: data you volunteered for a purpose, government benefits, legal duties, court orders, medical emergencies, disasters and employment (Section 7).
- Erasure has limits. A company may keep data needed for the original purpose or another law. The Act’s example is a bank holding ID records for ten years after an account closes.
- Some processing sits outside your rights, including enforcing legal claims, crime investigation, and a lender checking the assets of someone who defaulted (Section 17(1)).
- The government can exempt notified agencies and classes of companies, including startups (Section 17(2)-(3)).
- Children need parental consent and cannot be tracked or shown targeted ads, with narrow exceptions (Section 9).
What Apps Must Tell You: Understanding Consent Notices
Rule 3 applies from 13 May 2027. A notice must stand on its own, not hide in terms and conditions. It must use plain language and give an itemised description of your data, the specific purpose and the service it enables. It must also say how to withdraw consent, use your rights and complain to the Board.
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to necessary data (Section 6(1)). The Act’s own example is a telemedicine app that also asks for your contact list: your consent covers only what telemedicine needs. A clause waiving your right to complain is invalid, and the company must prove it gave notice and obtained consent.
| A notice that works (illustrative) | A red flag (illustrative) |
|---|---|
| “We collect your name, mobile number and PAN to verify your identity.” | “We may collect personal and other information.” |
| A separate tick-box per purpose | One tick-box for verification, marketing and sharing |
| Withdraw in app settings in a few taps | Withdraw only by letter |
Existing users are covered too: companies must send earlier consenting users a fresh notice “as soon as reasonably practicable” (Section 5(2)). Where processing happens also shapes risk, as our explainer on edge AI vs cloud AI shows, but the Act asks one question either way: who decides why and how your data is used?
DPDP Act Timeline: What Applies Now and What Comes Later
| Date | What happens |
|---|---|
| 11 Aug 2023 | Act passed; commencement left to notifications (Section 1(2)). |
| 13 Nov 2025 (in force now) | Rules 1, 2 and 17-21 apply: the Board’s set-up, appointments and digital office. Per the commencement notification as summarised by AZB, Act Sections 1(2), 2, 18-26, 35, 38-43 and 44(1), 44(3) also began. |
| 13 Nov 2026 (under three weeks away) | Rule 4: Consent Manager registration begins, with Act Sections 6(9) and 27(1)(d). |
| 13 May 2027 | The rest: Rules 3, 5-16, 22, 23 (notices, security, breach alerts, erasure, your rights, appeals) and the Act’s consent, rights, complaint and penalty provisions. IT Act Section 43A is removed (Section 44(2)). |
Reports in early 2026 said the government might shorten the window for large “significant” companies. We found no notified change, so 13 May 2027 stands. Check the MeitY website for updates.
What this means today: your new rights are not yet enforceable, and the Board cannot take complaints. A public-records tracker, India Data Law, reported in October 2026 that no Chairperson or Members had been appointed. Until May 2027, older rules, including IT Act Section 43A and regulators’ sector rules, still apply.
How to Ask an App to Delete Your Personal Data
- Find the company’s route. Rule 14(1) requires it to publish how to make requests and which identifier it needs. Check app settings, the privacy policy or the data officer’s contact.
- Withdraw consent and request erasure together. The company must then stop processing and erase your data, unless a law requires it to keep it, and make its processors erase too (Sections 6(6), 8(7), 12(3)).
- Use the official channel and keep a screenshot or ticket number.
- Wait for the published reply period, at most 90 days, then escalate (see the next section).
Expect exceptions. Logs and related data must be kept for at least a year (Rule 8(3)), and banks and lenders keep legally required records. Large platforms must erase inactive users’ data after three years, with 48 hours’ warning: e-commerce and social media firms with 2 crore or more users in India, and gaming platforms with 50 lakh or more (Rule 8, Third Schedule).
Sent before 13 May 2027, this is a request, not yet a legal demand under the DPDP Act. Keep a copy to follow up later.
How to Complain to the Data Protection Board of India
You cannot yet. The Board’s power to take complaints and impose penalties starts on 13 May 2027, and the public records we found show no appointed members. When it opens, the route is:
- Complain to the company first. The Act requires you to use its grievance system before approaching the Board (Section 13(3)). Note the reference number.
- Collect evidence: consent screens, emails, ticket numbers and any breach message.
- File online. The Board is a “digital office” (Rule 20), and the government says complaints can be filed and tracked through a portal and app. None is live yet, so beware of sites offering to file for you.
- Know what follows. The Board may order urgent fixes, direct mediation, accept an undertaking or impose a penalty (Sections 28-33), aiming to finish inquiries within six months (Rule 19(9)).
- Appeal to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (Section 29).
False or frivolous complaints can draw a warning or costs (Section 28(12)). Meanwhile, complain to the company and any sector regulator, such as the RBI’s complaint portal for banks and lenders.
Data Breach Compensation in India: What Can You Claim?
Under the DPDP Act, nothing fixed. The Act punishes organisations but does not let the Board pay you; we read the full Act and found no compensation provision.
| Penalty (DPDP Act) | Compensation to you | |
|---|---|---|
| Paid to | Government’s Consolidated Fund (Section 34) | You |
| Decided by | The Board | Not provided in the Act |
| Maximum | ₹250 crore for weak security; ₹200 crore for not reporting a breach or breaching child-data duties; ₹150 crore for significant-company duties; ₹50 crore otherwise | No formula |
The Act’s only gentler route is Board-directed mediation (Section 31). Until 13 May 2027, IT Act Section 43A lets you claim damages from a company that negligently failed to protect sensitive personal data. Claims up to ₹5 crore go to an adjudicating officer. That section then disappears.
Afterwards, lawyers in Bar & Bench point to untested routes: a negligence suit, a consumer complaint for “deficiency in service”, or a writ against a government body. Section 39 bars civil courts from matters the Board can decide. Never expect a fixed payout, and keep every breach notice and loss record.
What the DPDP Act Means for Loan Apps
Loan apps hold your ID, income, contacts and repayment history. Regulated lenders already follow the RBI’s Digital Lending Directions, 2025. Law-firm summaries say these require need-based data collection with explicit consent, bar access to files, contacts and call logs, and allow one-time camera, microphone or location access only for onboarding and KYC. We could not open the RBI text, so check it directly. From May 2027, the DPDP Act adds an itemised notice, easy withdrawal, erasure, breach alerts and penalties up to ₹250 crore for weak security, and it also covers apps outside the RBI’s net.
- Example: a quick-loan app asks for contacts and gallery access to approve a small loan. Neither is needed to assess credit, and the Act’s telemedicine example shows consent covers only necessary data.
- Deletion has limits. You cannot erase the record of a loan you still owe, or data the lender must keep by law. Lenders may also trace a defaulter’s assets (Section 17(1)(f)).
- Check legitimacy. The RBI publishes a list of apps reported by regulated lenders, built without further validation. A listing is not an endorsement.
- Count the cost too. Our guide to no-cost EMI hidden charges covers the other half.
Frequently Asked Questions
What rights do I have under the DPDP Act?
You can get a clear notice, withdraw consent, access, correct and erase your data, use a grievance system, nominate someone to act for you and complain to the Data Protection Board.
Can I ask an app to delete my data?
Yes. Section 12(3) requires erasure on request unless the data is still needed for its purpose or a law. The right is enforceable from 13 May 2027; the template above works now as a request.
When do the DPDP Rules fully apply?
On 13 May 2027, eighteen months after publication. The Board rules apply already, and the Consent Manager rule starts on 13 November 2026.
What is a Consent Manager?
A company registered with the Board that lets you give, manage, review and withdraw consent on one platform. It must be incorporated in India with net worth of at least ₹2 crore, act as your fiduciary, be unable to read your data and keep consent records for seven years (Rule 4, First Schedule).
Can I withdraw my consent?
Yes, at any time, as easily as you gave it. Earlier lawful processing stays valid, and you bear the consequences, such as losing the service (Section 6(5)).
Can I receive compensation after a data breach in India?
The DPDP Act sets none; penalties go to the government. Until 13 May 2027, IT Act Section 43A offers a damages route. After that, you would rely on untested legal routes.
Where can I complain about misuse of my personal data?
First to the company’s grievance officer, then, from 13 May 2027, to the Data Protection Board. If money was stolen, act now: our guide to online scams in India explains how to report on 1930.
