Law note · India
Digital Personal Data Protection Act, 2023, data subject rights
cite Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14
stage IMMINENT in force in 256 days
effective 2027-05-13
kind Data subject rights
binds public and private bodies
reviewed 2026-08-29
What it requires
- An Indian data principal's rights to access, correct, complete, update, or erase their personal data, including a stored voiceprint or faceprint, and to nominate another person to exercise these rights, have not yet commenced and are scheduled to take effect 13 May 2027. Once in force, an app must give a data principal a way to exercise these rights against it directly, with escalation to the Data Protection Board available only after the app's own grievance process is exhausted.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
Once in force, a data principal may demand a summary of their processed personal data and the identities of the Fiduciaries and Processors it was shared with (s.11), correction, completion, updating and erasure (s.12), grievance redressal against the Fiduciary in the first instance with a complaint to the Board only after that process is exhausted (s.13), and a right to nominate another individual to exercise these rights on death or incapacity (s.14).
No express portability or objection right appears in the Act text as read. None of this currently binds; Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as Chapter III's commencement date.