Your rights under the DPDP Act, and how to use them

The DPDP Act gives every person in India a set of rights over their digital personal data. Rights only matter if you can use them, so this guide covers what each one means and how to exercise it.

1. The right to withdraw consent

If you consented to a company using your data, you can withdraw that consent at any time. The law says withdrawing must be as easy as giving consent: if you agreed with one tap, you should be able to withdraw with one tap.

Once you withdraw, the company, and any vendor processing data for it, must stop processing your data within a reasonable time, unless a law requires them to keep it. Withdrawal does not undo processing that already happened lawfully, but it stops what comes next.

In myconsentapp: open the consent and tap Withdraw. The company is notified by signed webhook, and you get a signed receipt as proof.

2. The right to information

You can ask a company for:

• a summary of the personal data it processes about you, and the processing it does;
• the identities of other companies it has shared your data with, and what was shared.

3. The right to correction and erasure

You can ask a company to correct inaccurate or misleading data, complete incomplete data, and update data that has changed. You can also ask it to erase data it no longer needs for the purpose you consented to, unless a law requires it to keep that data.

4. The right to grievance redressal

Every company, and every Consent Manager, must provide a readily available way to raise a grievance and must respond within the time set by the Rules. The Rules set an outer limit of 90 days.

You must use this channel first. If you are not satisfied with the response, you can then complain to the Data Protection Board of India.

5. The right to nominate

You can nominate another person to exercise your rights if you die or become unable to act, for example due to illness. This matters more than it sounds: without a nominee, your family may have no clear way to close accounts or erase data.

Your duties

The Act also places a few duties on you. You must not impersonate someone else, suppress material information when providing data for official documents, or file false or frivolous grievances. Breaching these duties can attract a penalty of up to ₹10,000.

A simple routine

1. Review the consents you have given once every few months.
2. Withdraw anything you no longer use.
3. Ask what is held whenever something feels off.
4. Keep receipts: signed receipts are proof of what you agreed to and when.
5. Name a nominee you trust.

myconsentapp brings all of this into one dashboard, on the web and on the mobile app. It is free, and always will be.