Check your rights over your personal data, and when they start

The provisions this tool rests on

The provisions below are the sources for the legal statements on this page. Each links to the official document it was verified against, and to the provision on this site wherever this site publishes that provision. The label says whether the site is reporting a requirement, explaining it, reading it, recommending something, or pointing at a text it does not restate.

• DPDP Act 2023, s. 11

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) The Data Principal shall have the right to obtain from the Data Fiduciary to whom she has previously given consent, including consent as referred to in clause (a) of section 7 (hereinafter referred to as the said Data Fiduciary), for processing of personal data, upon making to it a request in such manner as may be prescribed,— (a) a summary of personal data which is being processed by such Data Fiduciary and the processing activities undertaken by that Data Fiduciary with respect to such personal data; (b) the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared; and (c) any other information related to the personal data of such Data Principal and its processing, as may be prescribed. (2) Nothing contained in clause (b) or clause (c) of sub-section (1) shall apply in respect of the sharing of any personal data by the said Data Fiduciary with any other Data Fiduciary authorised by law to obtain such personal data, where such sharing is pursuant to a request made in writing by such other Data Fiduciary for the purpose of prevention or detection or investigation of offences or cyber incidents, or for prosecution or punishment of offences.

  Section 11 on this site Official source ↗

• DPDP Rules 2025, r. 14, (1)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) For enabling Data Principals to exercise their rights under the Act, the Data Fiduciary and, where applicable, the Consent Manager, shall prominently publish on its website or app, or both, as the case may be, — (a) the details of the means using which a Data Principal may make a request for the exercise of such rights; and (b) the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service.

  Rule 14 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Act 2023, s. 12

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force. (2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal,— (a) correct the inaccurate or misleading personal data; (b) complete the incomplete personal data; and (c) update the personal data. (3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.

  Section 12 on this site Official source ↗

• DPDP Act 2023, s. 13

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) A Data Principal shall have the right to have readily available means of grievance redressal provided by a Data Fiduciary or Consent Manager in respect of any act or omission of such Data Fiduciary or Consent Manager regarding the performance of its obligations in relation to the personal data of such Data Principal or the exercise of her rights under the provisions of this Act and the rules made thereunder. (2) The Data Fiduciary or Consent Manager shall respond to any grievances referred to in sub-section (1) within such period as may be prescribed from the date of its receipt for all or any class of Data Fiduciaries. (3) The Data Principal shall exhaust the opportunity of redressing her grievance under this section before approaching the Board.

  Section 13 on this site Official source ↗

• DPDP Rules 2025, r. 14, (3)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (3) Every Data Fiduciary and Consent Manager shall prominently publish on its website or app, or both, as the case may be, within a reasonable period not exceeding ninety days under its grievance redressal system for responding to the grievances of Data Principals and shall, for ensuring the effectiveness of the system in responding within such period, implement appropriate technical and organisational measures.

  Rule 14 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Act 2023, s. 40, (2)(o)

  Interpretation, requires judgment · Verified 26 August 2026

  In force since 13 November 2025

  Section 40 on this site Official source ↗

  Rule 14(3) as printed carries no object for "publish", so what the words "not exceeding ninety days" cap is not stated on the face of the text. This site reads them as capping the response period the organisation must publish, because section 40(2)(o) describes the thing to be prescribed as "the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13", and the same sub rule requires measures for responding "within such period". That reading is this site's and not a statement the printed rule makes.

• DPDP Act 2023, s. 14

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder. (2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.

  Section 14 on this site Official source ↗

• DPDP Rules 2025, r. 14, (4)

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.

  Rule 14 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Rules 2025, r. 9

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  Every Data Fiduciary shall prominently publish on its website or app, and mention in every response to a communication for the exercise of the rights of a Data Principal under the Act, the business contact information of the Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of her personal data.

  Rule 9 on this site Official source ↗ Also on MeitY (byte identical) ↗

• DPDP Act 2023, s. 15

  Official requirement · Verified 17 August 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  A Data Principal shall perform the following duties, namely:— (a) comply with the provisions of all applicable laws for the time being in force while exercising rights under the provisions of this Act; (b) to ensure not to impersonate another person while providing her personal data for a specified purpose; (c) to ensure not to suppress any material information while providing her personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities; (d) to ensure not to register a false or frivolous grievance or complaint with a Data Fiduciary or the Board; and (e) to furnish only such information as is verifiably authentic, while exercising the right to correction or erasure under the provisions of this Act or the rules made thereunder.

  Section 15 on this site Official source ↗

• DPDP Act 2023, The Schedule

  Official requirement · Verified 16 October 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  Breach in observance of the duties under section 15. ... May extend to ten thousand rupees.

  The Schedule to the Act on this site Official source ↗

  Entry 5 of the Schedule to the Act, Gazette page 21, quoted as its description cell and its penalty cell. The ellipsis stands for the intervening serial numbers and column text, because the text layer reads the table column by column; the row pairing was read against the printed order of entries 1 to 7 and penalties 1 to 7, and the India Code consolidated print at its page 24 sets the same row out in line.

• DPDP Act 2023, s. 33(1)

  Official requirement · Verified 16 October 2026

  Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed

  (1) If the Board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving the person an opportunity of being heard, impose such monetary penalty specified in the Schedule.

  Section 33 on this site Official source ↗

  Section 33(1) begins on Gazette page 16 and its sentence ends on page 17, where the rest of the hearing condition (from "person an opportunity of being heard") and the reference to the Schedule are printed. The quote joins the 2 pages across the marginal notes the text layer places between them.

• Notification G.S.R. 843(E), (c)

  Official requirement · Verified 17 August 2026

  Document status: published; in effect per its own terms

  eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.

  Official source ↗ Also on MeitY (byte identical) ↗

• Notification G.S.R. 843(E), p. 1

  Interpretation, requires judgment · Verified 17 August 2026

  Document status: published; in effect per its own terms

  Official source ↗ Also on MeitY (byte identical) ↗

  The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed. It aligns with the derived date for the main group of the DPDP Rules 2025.

• PIB release PRID 2261823, p. 1

  An official record, not a legal requirement · Verified 18 October 2026

  Document status: published official press release of 16 May 2026 on a MeitY workshop of 11 May 2026; it reports the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027; a press release and not an instrument, it cites no provision and no publication date

  Official source ↗

  A press release of 16 May 2026 reporting the Secretary, MeitY, in reported speech, as noting that the Act becomes fully enforceable from 13 May 2027: the only official statement this site has located, as at 18 October 2026, that names the date this group computes to. Not an instrument and not a confirmation; the period in paragraph (c) is what the notification states.