In one line
India's data protection law is in force on paper, but most of your rights only start on 13 May 2027. From then, apps must tell you what they hold on you, fix or delete it on request, and answer within 90 days.12
Does this apply to you?
Find yourself in the list.
From 13 May 2027 you can ask what data an app holds, have it corrected or erased, withdraw consent and name someone to act for you. Replies are due within 90 days.1
Large e-commerce and social platforms (2 crore+ users) and gaming platforms (50 lakh+) must erase your data after three years of inactivity, with 48 hours' notice first.2
Apps will need verifiable consent from a parent before processing a child's data, except for things like healthcare, education and safety.1
The company must tell you without delay, in plain language, what happened and what you should do, and file a detailed report with the Data Protection Board within 72 hours.12
Consent manager rules start on 13 November 2026 and everything else applies from 13 May 2027. Fines go up to Rs 250 crore.2
What the rule actually says
The plain version first, then the line from the primary document.
What breaking the law costs a company
These are the maximum fines the Data Protection Board can impose.1
- Leaving data unprotectedRs 250 croreReasonable security safeguards
- Not reporting a breachRs 200 croreTell users and the Board
- Mishandling children's dataRs 200 croreParental consent and safeguards
- Other violationsRs 50 croreNotice, consent, rights and the rest
What to do
- There's nothing to do today. The rights you'll use most start on 13 May 2027.
- After that, use an app's privacy or grievance contact to ask what it holds on you, or to correct or delete it. Keep a screenshot of your request.
- If there's no reply within 90 days, or the answer doesn't satisfy you, complain to the Data Protection Board. Complaints are filed and tracked online.1
- Parents should expect apps to ask for proof of age or a DigiLocker token before a child can sign up.2
The fine print
- The government can exempt its own agencies from parts of the law, so your rights against state bodies are weaker than against private apps.3
- Deletion on request isn't absolute. Companies can keep what another law requires them to keep, and must hold certain logs for a year.2
- Personal data can be sent abroad unless the government later restricts specific countries.2
- Appeals against the Board's decisions go to the telecom tribunal, TDSAT, not straight to a court.1
What we don't know yet
- The Data Protection Board exists in law, but as of September 2026 no chairperson or members had been appointed. MeitY invited applications on 6 May 2026.4
- MeitY proposed cutting the 18-month runway to 12 months in January 2026. No amendment has been notified, so 13 May 2027 still stands.34
- How strictly apps will check a child's age in practice.
Our take
On paper this is a decent law. You get the right to see, fix and delete what apps hold on you, a 90-day deadline and breach notices written in plain language. In practice it's 18 months from the rules to the rights, and almost a year in, the body meant to enforce them still has nobody in the chair.4 Until the Board is staffed and the first fines land, treat this as a promise and keep being careful about what you hand over.
Change log
Sources
- Press Information Bureau, explainer on the Digital Personal Data Protection Rules, 2025 (November 2025)
- AMLEGALS, DPDP Rules notified, rule-by-rule commencement (19 Nov 2025)
- S.S. Rana & Co. on Mondaq, MeitY's plan to shorten the DPDP timeline (15 April 2026)
- MirvoLegal, DPDP compliance timeline as at September 2026