Last verified: 21 May 2026. This article is a general explainer, not legal advice.
You have probably seen the headlines about India’s “new data protection law” and filed them under “things for companies to worry about”. But the Digital Personal Data Protection Act — the DPDPA — is, at its heart, a law about you: the person whose name, phone number, location and photos are sitting inside dozens of apps. Here is what it is, where it stands right now, and what it actually gives you as an ordinary phone user.
What the DPDPA is
The Digital Personal Data Protection Act was passed by Parliament in August 2023. It is India’s first comprehensive law dedicated to protecting personal data. Before it, data protection in India leaned on older, narrower rules under the Information Technology Act, which had not kept pace with how much of life moved onto smartphones.
The law uses two key terms worth knowing:
- A Data Principal is you — the individual the personal data is about. (For a child, the parent or legal guardian is the Data Principal.)
- A Data Fiduciary is any organisation that decides why and how your data is collected and used — an app, a website, a bank, a shopping platform.
The DPDPA covers personal data in digital form. It does not regulate paper records or non-personal data.
Where it stands now (2026)
This is the part that is easy to get wrong, so here is the honest current picture. The Act became law in 2023, but it could not function until the detailed rules underneath it were written. Those — the Digital Personal Data Protection Rules, 2025 — were notified by the government in November 2025.
Implementation is phased, not all-at-once:
- From November 2025: the administrative parts took effect, including the setting-up of the Data Protection Board of India, the body that will enforce the law.
- From November 2026: the rules around “consent managers” come into force.
- From May 2027: the main substantive obligations — proper consent, privacy notices, security requirements, breach notifications — become enforceable.
So as of 2026, the framework exists and the enforcement body is being stood up, but the day-to-day obligations on companies are still phasing in. It is a get-ready period, not a fully-switched-on one.
What it gives you as a user
Once in force, the DPDPA gives every individual a set of enforceable rights over their own data. In plain terms:
- The right to be informed. A company must tell you what personal data it is collecting, why, and who it will be shared with — in clear language.
- The right to access. You can ask a company for a summary of the personal data it holds about you and what it is doing with it.
- The right to correction. If the data a company holds about you is wrong or out of date, you can ask them to fix it.
- The right to erasure. You can ask a company to delete personal data it no longer needs to keep.
- The right to withdraw consent. If you agreed to something, you can change your mind later — and withdrawing should be as easy as giving consent was.
- The right to grievance redressal. Every company must give you a way to complain about how your data is handled, with a path to escalate to the Data Protection Board if they do not resolve it.
- The right to nominate. You can name someone to exercise your rights on your behalf if you die or become incapacitated.
Stronger protection for children
The law treats children’s data with extra care. Verifiable consent from a parent or legal guardian is required before processing the personal data of a child or of a person with a disability who has a lawful guardian. For Indian families, this is one of the more consequential parts of the law.
What you can do right now
You do not have to wait for 2027 to benefit. A few practical habits, in the spirit of the law:
- Read the consent screen, briefly. When an app asks for permissions or consent, skim what you are agreeing to.
- Use the rights companies already offer. Many apps already have “download my data” and “delete my account” options. You can use them today.
- Know who the grievance officer is. Responsible companies publish a grievance or data-protection contact. If something feels wrong, that is who to write to first.
- Withdraw consent you no longer want. Old apps you no longer use still hold your data. Deleting the account, not just the app, is what removes the data.
The bottom line
The DPDPA does not magically make your data private overnight, and its full force arrives in stages through 2027. But it marks a real shift: for the first time, Indian law treats your personal data as something you have enforceable rights over, and treats the apps and services holding it as accountable for what they do with it. Knowing the rights exist is the first step to using them.
This article is a general explainer, not legal advice. Data-protection rules are detailed and still phasing in; for decisions that carry legal or financial weight, consult a qualified professional.
