Indian Citizen Rights · DPDP Act 2023
Personal Data Action Centre
Your rights as a Data Principal are backed by statutory force. Generate verified legal notices to corporate Grievance Officers, revoke marketing consent, track response deadlines privately in your browser, and escalate unresolved violations to the Data Protection Board.
Direct Statutory Actions
Choose the right that matches your objective
Every request is anchored to a specific section of the Digital Personal Data Protection Act 2023 and includes pre-drafted legal citations.
Demand Data Erasure
Demand complete deletion of your personal data once the specified purpose has concluded or when you withdraw consent. Fiduciaries must erase data unless retention is explicitly required by law.
Revoke Marketing & Profiling Consent
Withdraw previously given consent for promotional emails, SMS, automated profiling, and third-party data broker sharing. The DPDP Act requires withdrawal to be as easy as giving consent.
Summary of Personal Data Held
Request a comprehensive summary of personal data held about you, the exact processing activities undertaken, and the identities of all third parties with whom your data has been shared.
Correct or Update Inaccurate Records
Require a Data Fiduciary to rectify inaccurate, out-of-date, or misleading personal data, or complete any incomplete records in their systems and databases.
Nominate a Successor
Designate a trusted individual who can exercise your data principal rights on your behalf in the unfortunate event of death or physical or mental incapacity.
Escalate Unresolved Grievances to DPB
If a Data Fiduciary fails to respond within 30 days or dismisses your valid statutory request without lawful justification, file an official complaint with the Data Protection Board of India.
Independent Privacy Protection
Private 30-Day SLA Request Tracker
Log your sent privacy requests to automatically monitor the statutory 30-day response window. Everything is stored locally in your browser — zero server uploads, zero accounts.
Company Directory
Find verified Grievance Officers & SLAs
Need to contact a specific Indian app or enterprise?
Browse our directory of 200+ verified Grievance Officers across payments, food delivery, e-commerce, banking, and ride-hailing — complete with official privacy policy links and last-verified dates.
Statutory Principles
Legal rules, response timelines & your rights
Understand the statutory frameworks governing personal data requests under Indian law.
When can you legally demand personal data erasure?
Under Section 12(3) of the DPDP Act 2023, you can demand erasure when (a) you withdraw your consent for processing, or (b) the specified purpose for which personal data was collected has been satisfied. The Data Fiduciary must erase your data unless retention is necessary to comply with an obligation under Indian law.
When can an Indian business legally refuse to erase certain records?
Data Fiduciaries operate under statutory retention mandates that override general erasure requests. Key examples include: (1) Tax and financial invoice records under the Income Tax Act & GST regulations (minimum 7–8 years); (2) Banking and payment transaction histories under RBI Master Directions and the Prevention of Money Laundering Act (PMLA); (3) KYC verification records under statutory financial regulations; (4) Records subject to pending litigation or court orders; and (5) Statutory exemptions under Section 17 of the DPDP Act. When a company refuses erasure of specific records, they must cite the exact legal provision and erase all non-mandatory data.
What is the statutory response timeline for Grievance Officers?
Section 8(9) read with Rule 14 mandates that every Indian Data Fiduciary must designate a Grievance Officer and resolve citizen requests in an efficient manner. The standard statutory window for substantive resolution is 30 days. Most reputable organizations provide an initial acknowledgment within 72 hours.
What should you do if a company ignores your request?
If 14 days pass without an acknowledgment, send a formal reminder quoting your initial communication and Section 8(9). If 30 days elapse without a substantive response, or if the company refuses without specifying a lawful retaining statute, you have the statutory right under Section 13(3) to escalate the dispute directly to the Data Protection Board of India.
Why does CheckDPDP not send emails automatically on your behalf?
For your security, privacy, and legal standing. Data Fiduciaries must authenticate Data Principal requests to prevent identity spoofing and unauthorized access. Companies verify that requests originate from the email or phone number registered with the user account. CheckDPDP generates precisely formatted legal notices client-side; you review the exact text and send it directly from your inbox, maintaining 100% control over your communications.