Your Rights
Data Principal control system
Access your data
Six enforceable actions that put the individual at the centre of how personal data is handled.
In simple words
You don't need a lawyer to use your rights. This page explains each one in everyday words and hands you the exact letter to send - just fill in your details.
The six rights
Chapter III of the Act spells out exactly what every individual can demand of any company that holds their personal data. No jargon - here's each right and what it means for you.The law gives every person six clear rights over their own data. Here is each one - and what it means for you - in plain, everyday words.
Ask any company what personal data of yours it is processing, what it does with that data, and the names of everyone else it has shared your data with.
Have inaccurate or misleading data corrected, incomplete data filled in, and out-of-date details updated - so decisions about you are made on the right facts.
Ask for your personal data to be erased once the purpose it was collected for is over - unless a law specifically requires the company to keep it.
Every company must give you an easy way to complain and respond within a set time. You use this before escalating to the Data Protection Board.
Name another individual to exercise your rights on your behalf if you die or are no longer able to act for yourself.
Take back consent as easily as you gave it. Once you withdraw it, the company must stop processing your data for that purpose.
Request studio · ready-to-send letters
Pick what you want to ask for, fill in a few details, and a formal letter that cites the right section of the Act assembles live on screen. Preview only - download, print and copy are disabled. Everything is built on your device, nothing is uploaded.
Ask an organisation for a summary of your data and who it was shared with.
Built entirely in your browser. Nothing you type here is uploaded or stored by this site.
To: [Organisation / Data Fiduciary]
Date: [Date]
Subject: Request to access my personal data under Section 11 of the Digital Personal Data Protection Act, 2023
Dear Sir or Madam,
I am a Data Principal whose personal data is processed by your organisation. Under Section 11 of the Digital Personal Data Protection Act, 2023, I request:
1. A summary of the personal data of mine that you are processing, and of the processing activities you undertake.
2. The identities of all other Data Fiduciaries and Data Processors with whom you have shared my personal data, with a description of what was shared.
3. Any other information about my personal data and its processing, as prescribed under the DPDP Rules, 2025.
Please respond within the period prescribed under the Act and the DPDP Rules, 2025. You can reach me at [your email].
Yours faithfully,
[Your name]
Preview only - download, print and copy are disabled for request letters.
Send the finished letter to the company's privacy or grievance contact, and keep a copy for your records.
If you're not heard
If a company won't co-operate, you have a clear path to escalate - all the way to the regulator and beyond.If a company won't help, you have a clear path to complain - step by step, all the way up to the government's Data Protection Board.
Every Data Fiduciary must give you a readily available way to complain - usually a Data Protection Officer or a Responsible Person. Start here and keep a written record.
If you gave consent through a Consent Manager - a Board-registered platform - you can review, manage and withdraw consent and raise concerns through it.
If the company doesn't resolve your grievance in the prescribed time, file a complaint with the Data Protection Board of India. It can inquire and impose penalties of up to ₹250 crore.
A Board order can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within the prescribed period.
For parents & guardians
Anyone under 18 is a child under the Act. If a service processes a child's data, stricter rules apply - and a parent or lawful guardian holds the rights.
A company must get the verifiable consent of a parent or lawful guardian before processing a child's personal data.
No processing that is likely to have a detrimental effect on the well-being of a child is allowed.
Behavioural tracking, monitoring and targeted advertising directed at children are prohibited.
The same protection applies to a person with a disability who has a lawful guardian.
The fine print
Your rights come with a few duties under Section 15. They exist to keep the system honest.
Questions
It's you - the individual the personal data is about. For a child, the parent or lawful guardian is the Data Principal; for a person with a disability, it's their lawful guardian.
No. Exercising your rights under the DPDP Act is free. A company cannot charge you for accessing, correcting or erasing your own data.
Within the time period prescribed by the DPDP Rules, 2025. Each company must publish its grievance timeline, and you can escalate to the Data Protection Board if it lapses.
Follow the grievance ladder: raise it with the company, then complain to the Data Protection Board of India, which can investigate and impose penalties.
Yes. Every letter is assembled entirely in your browser. Nothing you type is uploaded, stored or sent anywhere by this site.
From a free DPDP risk check to a board-ready roadmap, Anix TrustStack helps you manage AI and DPDP together - securely and sustainably.