What India's New Data Protection Rules Actually Give You

For years, Indians tapped “I Agree” on endless terms-and-conditions screens with little idea what actually happened to their data.

- TDG NETWORK

With the notification of the Digital Personal Data Protection (DPDP) Rules, 2025, that blind consent economy has, at least on paper, been pushed into a rights-based framework.

The rules, notified on November 13, 2025, fully operationalize the DPDP Act, 2023—India's first dedicated privacy law—through an 18-month rollout. They set timelines for compliance, spell out consent formats, and bring a new regulator, the Data Protection Board of India, into active play.

FROM FINE PRINT TO REAL RIGHTS

Under the Act and Rules, every person whose data is processed becomes a Data Principal. You now have:

Right to access: Ask any company what data they hold on you and why.

Right to correction & updating: Fix wrong or incomplete details.

Right to erasure: Get data deleted when it’s no longer needed for the stated purpose or legal obligations.

Right to withdraw consent at any time, with the same ease with which you gave it.

Right to grievance redressal and to escalate unresolved complaints to the Data Protection Board.