Your phone rings at 7:43 AM. Unknown number. A loan app you downloaded two years ago — and deleted — is offering you a pre-approved credit line. You never gave them permission to call. You’re not sure how they still have your number. And you have absolutely no idea how to make it stop.
That’s the situation millions of Indian consumers are in right now. The Digital Personal Data Protection Act 2023 (DPDPA) gives you real, enforceable rights over this data. The problem isn’t the law. The problem is that companies are counting on you to find the process too confusing, too slow, or too unclear to bother with.
This guide removes that excuse. Not what the law says (you can read that elsewhere), but exactly what you do, step by step, to exercise your rights today.
The short answer: The DPDPA gives you four statutory rights, and erasure (Section 12) is the one most people should use first. To exercise it, find the company’s grievance officer, send a written erasure request naming the specific data, and keep a dated copy. The template below is ready to send. If they ignore you, escalate to the grievance officer again, then to the Data Protection Board of India, whose powers are phasing in through 2027.
What DPDPA actually gives you
The DPDPA creates four statutory rights for data principals — that’s you, any individual (regardless of citizenship) whose personal data is processed in India.
The four statutory rights under the DPDPA 2023:
- Right to Access (§11): Ask any company what personal data they hold on you and how they’re using it.
- Right to Correction & Erasure (§12): Demand they fix inaccurate or outdated data. You can also require them to delete your data when you withdraw consent or when they no longer need it.
- Right to Grievance Redressal (§13): Every Data Fiduciary (any company processing your data) must have a grievance officer you can contact.
- Right to Nomination (§14): Designate someone to exercise your rights on your behalf in the event of death or incapacity.
These rights exist. They apply to every company operating in India that processes Indian residents’ data. What they don’t have yet is teeth — and we’ll get to that honestly in a later section.
The right most people should use first: erasure
The DPDPA data deletion request — formally, the right to erasure — is the most powerful right for most people. It’s the one that actually removes your data from a company’s systems, not just flags it.
Here’s what erasure covers: any personal data the company collected with your consent, once you withdraw that consent. Data collected for a specific purpose that is now complete. Data collected when you were a customer, after you’ve stopped being one.
Here is what it does not cover. Data a company must retain under law (tax records, KYC under RBI rules, court orders). Data processed for legitimate interests that override yours. And data involved in ongoing legal disputes. A bank cannot delete your loan history just because you ask. Jio cannot delete your billing records while telecom regulations require it to hold them.
So before you send a request, identify who actually holds your data. This step is non-obvious. Your name and phone number from a loan app inquiry four years ago is probably sitting in the databases of three credit bureaus, two lead-generation companies, and the original lender. You need to know who has it before you can ask for deletion.
The fastest way to find that out is a scan. See what a scan finds → walks through an example report of the data broker and company databases that can list your information. KnytX Shield isn’t live yet; join the waitlist to run your own at launch.
How to send a DPDPA erasure request
Once you know who holds your data, the process has four steps.
Step 1: Find the company’s Grievance Officer.
Every Data Fiduciary regulated under DPDPA is legally required to appoint a Grievance Officer and publish their contact details. Look in the company’s privacy policy — it should be there. If it’s not, that itself is a violation you can report. For large companies like Flipkart or Airtel, the Grievance Officer details are usually in the footer of their website under “Privacy Policy” or “Contact Us.”
Step 2: Write a formal erasure request.
This needs to be in writing — email works. Keep a copy.
Step 3: Be specific about what you want deleted.
Vague requests get vague responses. Name the data: your mobile number, your Aadhaar-linked profile, your purchase history, your location data. The more specific you are, the harder it is for the company to claim they didn’t understand what you were asking.
Step 4: Send it and note the date.
You’re creating a paper trail. If they ignore you, this becomes your evidence.
Here’s a template you can use immediately:
Subject: Request for Erasure of Personal Data — DPDPA 2023, Section 12
To: [GRIEVANCE OFFICER NAME]
[COMPANY NAME]
[COMPANY EMAIL]
Date: [DATE]
Dear [GRIEVANCE OFFICER NAME],
I am writing to formally request the erasure of my personal data held by [COMPANY NAME], in accordance with my rights under the Digital Personal Data Protection Act 2023 (DPDPA), specifically Section 12 (Right to Correction and Erasure).
My details:
- Full Name: [YOUR FULL NAME]
- Registered Mobile Number: [YOUR MOBILE NUMBER]
- Registered Email Address: [YOUR EMAIL ADDRESS]
- Account/Customer ID (if known): [ACCOUNT ID]
I hereby withdraw any consent I previously provided for the processing of my personal data. I request that [COMPANY NAME] permanently delete all personal data it holds relating to me, including but not limited to: name, mobile number, email address, physical address, Aadhaar-linked data (if any), browsing or usage history, and any derived or inferred profile data.
Please confirm in writing:
1. That this request has been received and logged.
2. The timeline within which erasure will be completed.
3. Any data that will be retained and the legal basis for retention.
If any portion of this request cannot be fulfilled, please provide the specific legal basis for retention as required under the DPDPA.
I expect acknowledgment of this request within a reasonable time, and full response no later than the timeline stipulated by applicable rules.
Regards,
[YOUR FULL NAME]
[YOUR MOBILE NUMBER]
[YOUR EMAIL ADDRESS]
[DATE]
Send this to the Grievance Officer directly. CC your own email address so you have a timestamped copy.
What is a company required to do with your request?
Under the DPDPA, companies must acknowledge your request and either fulfill it or provide a written refusal with legal grounds.
The honest reality on timelines: the core Act itself does not specify a number. It says “without undue delay,” which is deliberately vague. The DPDP Rules 2025, notified on 13 November 2025, set out the operational detail. But most of the substantive compliance obligations they carry phase in through 2027, so the binding response deadlines are still ramping up rather than uniformly in force today.
A valid refusal must cite a specific legal basis: a law requiring retention (like SEBI regulations for financial records), an ongoing contractual obligation, or a public interest ground. “We need it for analytics” is not a valid refusal. “We need it for our marketing” is not a valid refusal.
What acknowledgment should look like: a written confirmation with a reference number, the name of the officer handling it, and a stated timeline. If you get an automated “we received your email” with no follow-up within two weeks, treat that as non-compliance and move to escalation.
What can you do when a company ignores you?
Most companies will respond when they receive a formal DPDPA erasure request. Not out of civic spirit. It is because Grievance Officers know a complaint to the Data Protection Board of India (DPBI) creates documentation they would rather avoid. The process:
Step 1: Re-contact the Grievance Officer with a follow-up email referencing your original request, citing the date and reference number.
Step 2: Escalate to the DPBI. The Data Protection Board of India is the adjudicatory body under DPDPA. As of mid-2026, the Board has been formally established, and the DPDP Rules were notified in November 2025. But its full adjudication powers and the main complaint-handling machinery phase in through 2027. This is the honest picture: escalating to the DPBI is possible in principle, but the response timelines are still settling.
Step 3: Civil remedies. Section 32 of the DPDPA preserves your right to seek remedies through civil courts independently. This is a longer, more expensive path — but it’s real.
What this means in practice: the threat of a DPBI complaint carries more immediate weight than the complaint itself right now. Document everything. Send a final written notice to the company stating you will file with the DPBI. For large companies with legal teams, that letter alone often produces results.
DPDPA vs GDPR: the key differences
If you’ve read about GDPR — Europe’s data protection law — and wondered how DPDPA compares, here’s what actually matters for you as an Indian consumer.
Enforcement: GDPR has active enforcement with real penalties. The Irish Data Protection Commission fined Meta €1.2 billion in 2023. DPDPA enforcement is not yet active at that scale. The DPBI is established, and its rules are notified, but its full powers phase in through 2027. This gap will close, but it is real today.
Scope: GDPR covers all EU residents’ data, regardless of where the company processing it is located. DPDPA covers data principals located in India — Indian residents whose data is processed. It also applies to companies outside India that offer goods or services to Indian residents (the extraterritorial clause). So foreign apps processing your data are covered.
Consent withdrawal: Both laws give you the right to withdraw consent. Under GDPR, withdrawal must be as easy as giving consent — if you ticked a box, you must be able to untick it. DPDPA requires consent withdrawal to be “as easy to withdraw as it was to give,” similar language. In practice, companies build friction into the withdrawal process (buried settings, multi-step forms). That friction is itself a compliance failure.
Data portability: GDPR has an explicit right to data portability — receive your data in a machine-readable format and move it to another provider. DPDPA does not include an explicit portability right in the current text. This is a meaningful gap.
The key takeaway: if a company also processes EU residents’ data, they’re already GDPR-compliant and your DPDPA request will likely land in a workflow they already have. That often means faster responses.
The companies most worth targeting
Not all data deletion requests are equally productive. Here’s where your data is most likely to be held, and which companies are most likely to actually respond.
Telecom operators — Jio, Airtel, Vi — hold your Aadhaar-linked KYC data, call records, location history, and sometimes financial data. They’re heavily regulated, have established Grievance Officer processes, and respond to formal requests. They’ll retain some data under TRAI and DoT obligations (call detail records for 1 year minimum), but they can delete marketing profiles and third-party sharing consents.
Banks and NBFCs hold your PAN, Aadhaar, income data, transaction history, and credit behavior. They must retain core financial records under RBI guidelines, but they can delete marketing opt-ins, third-party data sharing permissions, and profile data from discontinued products.
E-commerce platforms — Flipkart and Amazon India — hold your address book, purchase history, browsing behavior, wishlist data, and payment method details. Neither is required to retain most of this under law. These are among the most productive targets for erasure requests because the legal retention basis is thin.
Health apps hold some of the most sensitive data you’ve ever shared — symptoms, diagnoses, menstrual cycles, medication history. Health data is personal data under the DPDPA, with heightened obligations applying to Significant Data Fiduciaries designated by the central government — not tiered by data category. Apps like PharmEasy, Practo, and 1mg have this data. They are high-priority targets.
Loyalty programs — airline frequent flyer programs, retail reward cards, hotel points programs — hold behavioral data going back years. If you’ve left a program, you almost certainly have no ongoing relationship that justifies retention. These are often the easiest wins.
Data brokers and lead-generation companies are the hardest to target directly under DPDPA. These are companies you have never directly interacted with, but who still hold your data. The problem is that identifying them requires knowing they exist. This is where a data scan tool becomes useful before you start filing requests.
Do you know how many companies currently hold a profile on you? Most people guess three to five. The actual number is typically closer to forty to sixty, including companies in sectors they’ve never interacted with directly.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.