India's DPDP Act in Plain English: What It Means for You as a User

In August 2023, India passed the Digital Personal Data Protection Act. It's the country's first comprehensive law about how companies handle your personal information. Most people have heard of it vaguely and know nothing about what it actually gives them.

This is a plain-English summary. It is not legal advice — for that, talk to a lawyer — but it should help you understand what you're entitled to.

The basic idea

The law introduces two roles:

• You are the Data Principal. The person the data is about.
• The company is the Data Fiduciary. The word "fiduciary" is deliberate — it's the same word used for a trustee managing someone else's money. The company is supposed to handle your data in your interest, not just its own.

A third role, Data Processor, covers companies that handle data on behalf of a fiduciary — a cloud host, say, or a payment gateway.

What companies must do

Ask for consent, properly. Consent must be free, specific, informed, and unambiguous. Pre-ticked boxes don't count. Burying consent in a 40-page terms document doesn't count. The request has to be in plain language, and it has to be available in English and any of the 22 languages in the Eighth Schedule of the Constitution if you want it.

Tell you why. Before or when they ask for data, they must say what it's for. They can only use it for that purpose.

Let you withdraw consent as easily as you gave it. If it took one tap to agree, it should take one tap to disagree. Companies can't make you phone a call centre to opt out of something you opted into online.

Delete data when it's no longer needed. Once the purpose is served — or you withdraw consent — the data has to go, unless another law requires keeping it (tax records, for example).

Protect it. Reasonable security safeguards are required, and if there's a breach, the company must notify both the Data Protection Board and the affected users.

Appoint someone you can complain to. Every company must have a contact for grievances, and larger ones must appoint a Data Protection Officer based in India.

Your rights

Right to access. You can ask a company what personal data it holds about you, what it's doing with it, and who it's shared it with. They must give you a summary.

Right to correction and erasure. You can ask them to fix wrong data and delete data that's no longer needed.

Right to grievance redressal. You can complain to the company's grievance officer first. If they don't respond within the time limit — currently expected to be within a few weeks — you can escalate to the Data Protection Board of India.

Right to nominate. You can name someone who can exercise these rights on your behalf if you die or become incapacitated. This is unusual internationally and quite thoughtful.

What the law does not do

It doesn't cover everything. Data you've made public yourself, and data processed for purely personal or domestic purposes, are outside it. Government agencies have broad exemptions for national security and law enforcement.

It doesn't regulate non-personal data. Aggregated, anonymised statistics aren't covered. Companies can keep using those.

It doesn't give you a right to compensation. Unlike Europe's GDPR, the DPDP Act doesn't let you sue for damages. Penalties go to the government, not to you. Your remedy is correction, erasure, and the company being fined.

It isn't fully in force yet. The Act was passed in 2023 but detailed rules were still being finalised and phased in through 2025 and 2026. Check current status before relying on a specific provision.

What this means in practice

If a platform asks for permission to read your contacts, you're entitled to know why, and to say no without losing access to unrelated features. If you delete your account, you're entitled to have your data removed, not just hidden. If you write to a company's grievance officer asking what they hold about you, they have to answer.

Companies that were already handling data responsibly won't notice much difference. Companies that were collecting everything "just in case" have a lot of work to do.

How Sanora One handles this

We've named a Data Protection Officer, published what we collect and why, set retention periods for each type of data, and built account deletion that actually deletes. Our Privacy Policy is written to be read, not just to be legally sufficient.

If you want to exercise any of the rights above with us, email Info@sanoraindia.com with "Privacy" in the subject line. We'll verify it's you and respond within 30 days.

The law gave you these rights. Use them — with us and with everyone else.