The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s first comprehensive data protection law. If you are an individual in India, it gives you rights you did not have before. Here is what matters, in plain language.
The short answer: The DPDPA gives you five rights over your personal data: access, correction, erasure, withdrawal of consent, and nomination. The law passed in 2023. Its rules were finalised and notified in November 2025, and the Data Protection Board of India has now been formally established. Penalty-backed enforcement of most obligations begins in stages through 2027. You can already exercise many of these rights by writing directly to a company’s grievance officer.
Your rights under DPDPA
Right to access — you can ask any company what personal data they have about you. They must respond.
Right to correction — if their data about you is wrong, you can demand they fix it.
Right to erasure — you can ask companies to delete your personal data. With exceptions (legal obligations, ongoing contracts), they must comply.
Right to withdraw consent — if you previously consented to data processing, you can take it back. The company must stop processing and delete the data.
Right to nominate — you can designate someone to exercise your rights on your behalf, including after death.
What companies must do
Any company processing Indian personal data must follow a few core rules. It must have a lawful purpose for collecting your data. It must collect only what is necessary and keep it only as long as needed. It must apply reasonable security measures and notify you of data breaches. It must also appoint a Data Protection Officer if the central government formally designates it a Significant Data Fiduciary (Section 10(2)).
Where enforcement stands in mid-2026
The law exists, and the machinery is now catching up. The DPDP Rules were finalised and notified on 13 November 2025. The Data Protection Board of India (the body that receives complaints and imposes penalties) has been formally established as a four-member body. But full penalty-backed enforcement of most obligations rolls out in stages, with the main compliance duties taking effect through 2027.
So there is still a gap in practice. Most Indian companies have not fully updated their data practices. Many data brokers ignore erasure requests. For a deeper look at that gap, read our guide to the DPDPA’s enforcement problem.
This is why automated tools help. You cannot individually fight every data broker, track every company, and follow up on every deletion request. KnytX Shield is built to do this systematically once it launches: exercising your DPDPA rights at scale, automatically.
What you can do today
Audit your exposure — search your name and phone number on Google. You’ll likely find yourself on people-search sites you’ve never heard of.
Exercise your rights — email companies that have your data and request deletion. The DPDPA requires them to respond.
Minimize new collection — use email aliases (KnytX Privacy Shield) for new signups. Disable unnecessary app permissions. Opt out of loyalty programs that sell data.
Automate protection — join the KnytX waitlist. Once Shield launches, it is built to handle the systematic removal and re-listing checks for you.
Your data is your right. The DPDPA confirms it. KnytX Shield is built to help you exercise it once it launches.