DPDP Rules notified November 2025 make data protection a fundamental right for every Indian. If Flipkart, Paytm, or any app leaks your Aadhaar, PAN, phone, or address – you now have 5 concrete legal rights with strict timelines and compensation up to ₹250 crore against companies.
Leaked data fuels 80% of digital arrest scams and UPI fraud – over ₹500cr lost in Delhi NCR 2025 alone. See our guides on online fraud and UPI fraud for scam recovery.
Over 1.4 billion Indians protected. 2,000+ weekly attacks per organization from UPI leaks to e-commerce hacks. This guide: exact rights + 7-step action plan.
What is DPDP Act 2025? 5 Rights Every Indian Has
DPDP regulates Data Fiduciaries collecting your data. Key shift: Your rights > corporate compliance.
| DPDP Act 2025 vs Old Privacy Laws |
| Right | DPDP 2025 | Old IT Act |
|---|---|---|
| Access Data | Anytime (7 days) | None |
| Correction | Mandatory | Voluntary |
| Erasure | Right to be forgotten | Undefined |
| Breach Notice | 72 hours | No timeline |
| Compensation | Consumer courts | Limited |
Right #1: Access Your Personal Data (7 Days)
Demand full data profile: searches, addresses, login history.
Example: “Show my Paytm transaction history + saved cards.”
Right #2: Correction of Wrong Data
Fix inaccurate PAN/DOB blocking loans/insurance.
Right #3: Erasure (“Right to be Forgotten”)
Permanently delete ex-employer/customer data. Section 12(7) strongest in India.
Right #4: Grievance Redressal (30 Days)
Guaranteed company response. No reply? → Data Protection Board.
Right #5: Nominee Rights
Appoint person for post-death data access/deletion.
Data Breach Happened! 7 Steps to Take NOW
72hr company notice deadline. Your speed = compensation amount.
Step 1: Demand Data Breach Notice
To: [company]@dataprotection.com
Subject: DPDP S.8(7): Breach Notice + Rights
Attach: ID proof
Step 2: File Data Fiduciary Complaint
Mandatory Grievance Officer email on homepage.
No 7-day reply? Immediate legal advice + formal notice.
Step 3: Data Protection Board (Q1 2026)
Databoard.gov.in → File → ₹250cr fines possible
Timeline: 6 months
Step 4: Consumer Court Compensation
Delhi District Forums (2yr limit):
New Delhi: 011-23383672
South Delhi: 011-24690449
₹5L+ mental harassment precedents
Step 5: Criminal Breach → Cyber Cell
Data sold dark web? Follow cybercrime reporting guide + IT Act S.66.
Step 6: Class Action (50+ Victims)
Consumer Court group filing = faster/higher awards.
Step 7: International Breaches
Instagram/FB/Google: Data Board coordinates globally.
Who Must Comply? Data Fiduciary List
| Major Companies (DPDP Mandatory) |
| Type | Examples | Data Risk |
|---|---|---|
| E-comm | Flipkart/Amazon | PAN/Address |
| UPI | PhonePe/Paytm | Aadhaar/OTP |
| Social | Instagram/X | Contacts/Location |
| Health | Practo/Pfizer | Medical Records |
Corporate DPDP audit? Corporate lawyer Delhi.
Compensation Amounts You Can Claim
Precedents:
₹25L: IndiGo leak (2023)
₹11L: MakeMyTrip breach
₹5L+: Mental distress (Delhi)
Formula: Loss + 2x Harassment + Costs.
Data Board: ₹250cr fines → victim compensation share.
Children’s Data: Strict Parental Consent Rules
Under-18: Verifiable parent OTP mandatory.
✅ School apps OK
❌ EdTech without consent = ₹50L fine
Parent rights: Full access/erasure anytime
Delhi NCR Filing Locations
| Data Forums Delhi NCR |
| Authority | Contact | Area |
|---|---|---|
| Data Board | databoard.gov.in | National |
| New Delhi DCF | 011-23383672 | Central |
| Saket Court | 011-29988199 | South |
| Noida Forum | 0120-2549032 | Noida |
FAQs
1. DPDP Act my rights? Access/Correction/Erasure/Grievance/Nominee.
2. Company notify data breach?
72 hours mandatory.
3. Erasure request process?
Grievance Officer → 7 days → Data Board.
4. Compensation amount?
₹1-25L Consumer Court.
5. Grievance timeline?
Company 7 days | Board 6 months.
Conclusion
Facing a data breach or denial of DPDP rights? Start with the company’s Grievance Officer, escalate to Consumer Court, and preserve all communication records. LegalCrusader guides Delhi NCR residents through data protection claims, from breach notices to compensation recovery.
Protect your digital identity today – DPDP 2025 makes it your legal right, not just a corporate courtesy.
Data leaked? Urgent civil lawyer near me for breach notice.
