Data Protection and Privacy Rights Under India’s Digital Personal Data Protection Law

To strengthen individual privacy, the Indian Parliament introduced the Digital Personal Data Protection Act, 2023 (DPDP Act). This legislation establishes a framework for processing digital personal data and defines responsibilities for organisations handling such information. It aims to protect individuals while allowing lawful use of personal data.

What Is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023, is an Indian law designed to regulate the processing of digital personal information. It applies to digital personal data collected within India and, in certain circumstances, data processed outside India in connection with offering goods or services to individuals in India.

Under this legislation, organisations determining the purpose and means of processing personal data are known as Data Fiduciaries. Individuals whose personal data is being processed are known as Data Principals.

The Digital Personal Data Protection Rules, 2025 were notified in November 2025. However, different provisions have different commencement dates, with several major compliance requirements scheduled to become effective in May 2027.

Important Privacy Rights Under Indian Law

The legislation provides individuals with several rights concerning their personal information.

1. Right to Access Information

Individuals can seek information about the personal data being processed, subject to the applicable provisions of the law. This promotes transparency and helps people understand how organisations use their information.

2. Right to Correction and Erasure

Individuals have rights to request correction of inaccurate or incomplete personal information and erasure of personal data where legally applicable. These rights are subject to statutory requirements and exceptions.

3. Right to Withdraw Consent

Where personal data is processed based on consent, individuals can withdraw their consent. Organisations must provide a withdrawal mechanism that is as easy as the process used to provide consent.

4. Right to Grievance Redressal

Individuals can raise complaints with the concerned organisation regarding the processing of their personal data. If their grievance is not adequately addressed, they may approach the Data Protection Board of India as permitted under the applicable legal framework.

5. Right to Nominate

An individual can nominate another person to exercise their rights in the event of their death or incapacity, subject to the provisions of the Act.

Responsibilities of Organisations Handling Personal Data

The DPDP Act also places responsibilities on organisations that collect and process personal information.

Some important responsibilities include:

• Obtaining valid consent wherever required under the law.
• Providing clear information about the purpose of collecting personal data.
• Taking reasonable security measures to protect personal information.
• Informing affected individuals and the relevant authority about personal data breaches as prescribed.
• Erasing personal information when the purpose is no longer served, subject to applicable legal requirements.
• Establishing effective grievance-redressal mechanisms.

These obligations encourage businesses to adopt responsible data-handling practices and improve digital privacy protection.

How Can Individuals Protect Their Personal Information?

Although legal protection is important, individuals should also take precautions while using digital platforms.

Some useful practices include:

• Avoid sharing sensitive personal information on unverified websites.
• Use strong and unique passwords for online accounts.
• Enable two-factor authentication wherever available.
• Avoid clicking suspicious links received through emails or messages.
• Review privacy settings on social media platforms.
• Report suspected identity theft or unauthorised data access.
• Keep records of suspicious communications and relevant transactions.

If personal information is misused, individuals should preserve available evidence and seek appropriate legal guidance.

Legal Remedies for Data Privacy Violations in India

Individuals affected by personal data misuse may have legal remedies depending on the circumstances and the provisions currently in force.

They can raise a complaint with the concerned organisation, report associated cybercrime through the appropriate channels, and approach the relevant legal authorities where applicable.

The Digital Personal Data Protection Act also provides for the Data Protection Board of India to address specified complaints and statutory violations once the relevant provisions become effective.

Understanding applicable Cyber Laws can help individuals identify their legal rights and take appropriate action against online privacy violations.

How Legal Eye Can Help With Data Privacy Concerns

Data privacy disputes can involve complicated legal questions, particularly when personal information is shared without permission, misused by organisations, or exposed through security breaches.

Legal Eye, under the guidance of Advocate P.S. Khurana, provides legal consultancy and assistance in matters involving digital rights, online disputes, privacy concerns, and related legal issues.

Individuals and businesses seeking legal assistance in Chandigarh, Mohali, and Panchkula can consult Advocate P.S. Khurana and his team to understand their legal options, applicable regulations, and available remedies.

Frequently Asked Questions (FAQs)

1. What is the Digital Personal Data Protection Act, 2023?

It is an Indian legislation that regulates the processing of digital personal data and establishes rights for individuals and responsibilities for organisations.

2. Can I request a company to delete my personal information?

Yes. Individuals have the right to request erasure of personal data under applicable conditions, subject to legal requirements and exceptions.

3. What should I do if my personal data is misused?

Preserve relevant evidence, contact the concerned organisation, report any associated cybercrime through appropriate channels, and seek legal advice.

4. Who handles complaints under the DPDP Act?

The Data Protection Board of India is the statutory authority responsible for handling matters assigned to it under the Act.

5. Is the DPDP Act applicable to businesses in Chandigarh and Mohali?

The Act’s applicability depends on the nature and location of data processing and the statutory conditions. Businesses operating in Chandigarh, Mohali, and Panchkula should assess their obligations under the law.