Your data, your rights
AI runs on data, often about you. India's Digital Personal Data Protection Act, 2023 gives you rights over your personal data. Here are the basics, compared with Europe's GDPR.
In 60 seconds
Your data, your rights
AI runs on data, often about you. India's Digital Personal Data Protection Act, 2023 gives you rights over your personal data. Here are the basics, compared with Europe's GDPR.
India's law in simple words
| Idea in the DPDP Act | What it means for you |
|---|---|
| Consent | In most cases, organisations need your clear consent for a specific purpose, and should tell you what data they collect and why. |
| Withdraw consent | You can take back your consent, and it should be about as easy as giving it. |
| Access information | You can ask what personal data an organisation has about you and how it is being used. |
| Correction and erasure | You can ask for wrong data to be corrected or updated, and for data to be erased when it is no longer needed for its purpose (subject to legal exceptions). |
| Grievance redressal | Organisations must have a way to handle your complaints. If that fails, you can approach the Data Protection Board of India. |
| Nominate someone | You can name a person to use your rights if you die or become unable to act. |
| Children's data | Extra protection applies, including consent from a parent or guardian. |
How Europe's GDPR compares
| Topic | India (DPDP Act) | EU (GDPR) |
|---|---|---|
| Main legal basis | Mostly consent, plus certain listed legitimate uses | Several legal bases, including consent, contract and legitimate interests |
| Rights | Access, correction, erasure, grievance, nomination | Access, correction, erasure, data portability, objection and more |
| Automated decisions | No specific separate right of this kind in the Act | Rules on certain decisions made solely by automated means |
| Regulator | Data Protection Board of India | Data protection authorities in each EU country |
Using your rights
- 1
Read the notice
Before agreeing, check what data an app wants and why. - 2
Give only what is needed
If a torch app wants your contacts, ask why. - 3
Ask and correct
Use the app's privacy or grievance contact to ask what they hold and fix errors. - 4
Withdraw or erase
If you stop using a service, ask them to delete your data where the law allows. - 5
Escalate if needed
If the organisation does not respond properly, use the official complaint route.
Watch and read more
Lab
A privacy check of one app you use, plus a drafted data request.
The problem
Choose one app you use often (a shopping, social, payment or AI app).
- Read its privacy policy and note: what data it collects, why, and who it shares with.
- Find the grievance or privacy contact.
- Check whether you can see, download, correct or delete your data in the app.
- Draft a short, polite request asking what personal data they hold about you and how it is used. You do not have to send it.
- Write three sentences on whether the app seems respectful of your rights.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Why is “consent” alone sometimes a weak protection?Reveal
Because people often click “I agree” without reading long policies, or feel they have no real choice if they need the service. Consent works best when notices are short and clear, choices are genuine, and the law also limits what organisations may do regardless of consent, such as using data only for the stated purpose and deleting it when no longer needed.
Q2Why is deleting data from a trained AI model harder than deleting a row in a spreadsheet?Reveal
A trained model does not usually store records in neat rows; what it learned is spread across many numbers. Removing the influence of one person's data may require retraining or special techniques that are still being researched. This is one reason privacy experts stress collecting less data and handling it carefully before training.
Questions people ask
Does the DPDP Act apply to AI companies?
It applies to organisations that process digital personal data in India, and in some cases to those outside India offering goods or services to people in India. AI companies that handle such data are generally covered, subject to the Act's exceptions and rules.
Can I ask a chatbot company to delete my chats?
Many services let you delete chat history in settings. Under data protection laws you may also be able to ask for erasure of personal data, with some exceptions. Check the service's privacy policy and contact its privacy or grievance officer.
Is publicly posted information protected?
Laws treat this differently. The DPDP Act has exceptions for some personal data that a person has made public themselves. Even so, think carefully before posting personal details, because others may collect them.
What should I do if my data is leaked?
Change passwords, watch for suspicious messages and inform your bank if financial data is involved. Report cyber fraud at cybercrime.gov.in or call 1930 in India. For legal options, talk to a qualified legal professional.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.