Citizens' Rights: your data, your complaints, step by step

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

This section explains, in plain words, what your rights are when a company or a caller misuses your personal data, and exactly where to complain. The DPDP Act gives you new rights from 13 May 2027. Until then, the rules of each sector (TRAI, RBI, IRDAI, the IT Rules and consumer law) already protect you. Each guide covers both.

Lost money or being threatened right now?

1. Call 1930 (cyber crime helpline) at once.
2. Call your bank on the number printed on your card and block the card, UPI and net banking.
3. File the full complaint on cybercrime.gov.in. Step by step.

What happened to you?

Each situation starts with your rights and how to fight it, step by step. If the caller turns out to be genuine staff or an agent, the page shows how to hold the company accountable; if fake, the urgent steps. Browse by sector.

• A caller from a personal number knew all my bank details: genuine bank staff or fraud? Someone said they were from your bank or its agent, called from a personal mobile, and knew your details.
• Someone called with personal details I never shared with them A caller knew your name, address, purchases or family details, and named a company.
• I got a KYC update message or call: is it really my bank? A message or call says your KYC is pending and your account will be blocked.
• A delivery person or courier kept my number and is contacting me A delivery person messages or calls you after delivery, or a 'courier' calls about a parcel.
• A ride app driver keeps calling and texting me from different numbers after the ride After a trip, the driver sends messages like 'Hi' or 'call me' on SMS or WhatsApp, from more than one number.
• A self-drive car rental host has my licence, ID and number, and is misusing them You rented on a platform like Zoomcar where the car belongs to a private host, and the host now contacts you or misuses your documents.
• A video call says I am under 'digital arrest' by police, CBI or customs A caller in uniform on video says you are under arrest and must pay or stay on the call.
• A loan app or recovery agent is calling my relatives and friends A recovery agent calls your family, friends or contacts, or threatens you.
• My credit report shows a loan I never took A loan or card you never applied for appears on your credit report.
• My SIM suddenly stopped working Your SIM lost network without warning, possibly because someone got a duplicate SIM.
• A SIM was taken in my name, or telecom staff leaked my details Sanchar Saathi shows numbers you never took, or a telecom employee or retailer shared your data.
• A seller from a shopping app contacted me on WhatsApp or by phone After an order, a seller messages you directly, to sell, ask for reviews, or offer refunds outside the app.
• An insurance agent knows my policy details and keeps calling An agent or 'advisor' knows your policy, sum assured or renewal date.
• A hospital or lab staff member shared my reports on WhatsApp Your test results or medical records were shared without your consent.
• My employer shared my personal data with others Your employer or its vendor shared your salary, bank, medical or ID details.
• My housing society shared residents' data or CCTV footage The committee or security agency shared your phone number, flat details or CCTV clips.
• My child's school app collects too much or shares my child's data A school or ed-tech app collects or shares more than it needs about your child.
• A company told me my data was leaked in a breach You got a breach notice, or read that a company you use was hacked.
• A company keeps sending marketing after I said stop Calls, SMS or emails continue after you opted out or registered DND.
• A customer care number turned out fake, or a real agent misused my data A helpline number you found online led to a scammer, or a real support agent misused your details.
• Someone made a fake profile using my name or photos An account impersonates you or uses your photos.
• My phone was lost or stolen, or a repair shop accessed my data Your phone is gone, or a shop or person who had it misused what was on it.
• A bank employee told someone I know about my balance, loans or statement Someone in your circle knew your bank balance, loan or account statement, and it seems to have come from bank staff.
• My bank shared my account details or statement with my employer Your salary bank or loan bank gave your employer details or a statement you did not authorise.
• A scammer knew my branch and that my KYC was pending, so the leak must be from the bank A fraud call or SMS quoted your branch, your account type or a pending KYC update.
• A credit card telecaller on a personal mobile knew my PAN, employer and even my other bank A sales caller pushing a card or loan quoted your PAN, employer and accounts at another bank.
• A loan or card agent admitted my details came from a bank branch An agent told you openly that a branch employee gave them your details.
• Right after I got a new card, a caller knew the card number and my PAN Within days of a new card arriving, a caller quoted its digits and your PAN.
• A reward points or limit upgrade call used my real card limit and address A caller offering to redeem points or raise your limit knew your real limit and address, and asked for an OTP.
• A credit card was issued and activated in my name without my consent A card you never asked for arrived, was activated, or appeared on your credit report.
• My own bank's loan or card sales team calls me every day Your bank keeps calling to sell loans or cards, even after you said no.
• My bank says its customer data was found on the dark web Your bank or a news report says customer data from your bank was leaked.
• My new number gets the previous owner's bank OTPs and recovery calls, or my old number was given away Mobile numbers are recycled. You now get someone else's OTPs and loan calls, or your own unused number went to a stranger.
• The SIM shop took my fingerprint twice and an extra SIM was issued on my Aadhaar A retailer asked you to scan again, and later Sanchar Saathi showed a second SIM in your name.
• Someone got a duplicate of my SIM and emptied my bank account Your phone lost signal, and soon after money left your account using OTPs sent to your number.
• My broadband or mobile provider's data seems to feed spam calls Right after a new connection or plan change, spam calls start quoting it.
• Someone listed me as a loan reference without asking, and agents now threaten me A friend, colleague or stranger named you as a reference and recovery agents now call you.
• A relative gave my number to their lender and now I get the recovery calls Your number was given as a contact for someone else's loan.
• Recovery agents called my office, HR or colleagues Agents contacted your workplace about your loan.
• A loan app read my contacts and messaged everyone that I am a defaulter Your friends and family received messages calling you a fraud or defaulter.
• A loan app is threatening to send morphed nude photos of me Agents say they will share edited intimate photos unless you pay.
• Money was credited by a loan app I never applied to, and now they demand repayment An unknown amount landed in your account and agents demand much more back.
• My credit report shows loans or enquiries I never made Your credit report lists a loan, card or enquiry you do not recognise.
• I checked my credit score on a marketplace app and now banks and agents call nonstop After using a free credit score or loan marketplace app, loan and card calls started.
• One loan eligibility form gave me dozens of calls and OTPs a day You filled one online form and now get OTPs and calls from many lenders.
• A caller ID app shows my name and details to strangers People who never had your number see your name, or a wrong or offensive name, when you call.
• Before my car insurance renewal, dozens of agents call and WhatsApp me Weeks before your motor policy expires, agents from many companies call with your car and policy details.
• Agents from other insurers know my health policy and push me to port Callers know your health insurer, sum insured and renewal date, and push you to switch.
• My insurer passed my details to an aggregator or partner You bought from an insurer, and an aggregator or partner you never used now contacts you.
• I took one quote on an insurance aggregator and the calls never stop After one online quote, calls from the aggregator and insurers continue for months.
• A caller from 'IRDAI' or the Insurance Ombudsman said I can get a refund on my old policy Someone claiming to be from IRDAI or an ombudsman promised a refund or bonus for a fee.
• An agent forged my signature and bought a policy using my KYC A policy you never agreed to was issued using your documents, and premiums are being demanded or debited.
• Can my employer see my health claims through the group policy? You are worried HR can see your diagnosis through the company health cover.
• After buying a new car I get roadside assistance, resort and holiday package calls Soon after registering a new vehicle, callers know your car, registration and address.
• Anyone can look up my vehicle number and get my name and address Apps and websites show owner details from a registration number.
• I listed my car for sale and got flooded by dealers and brokers After one listing on a car selling site, dealers call all day, even after it is sold.
• The dealership or service centre keeps my KYC copies and my data leaks from there A dealer has copies of your Aadhaar, PAN and address, and you suspect leaks.
• A message says my FASTag, electricity or utility will be cut unless I click a link An urgent SMS or WhatsApp says your service will stop tonight unless you pay or update details.
• The car rental app's face check failed after I paid and I could not get my money back You paid for a self drive booking, then the app's identity check failed and the refund is stuck.
• As a host, my car was taken by someone who did not match the account You list your car on a sharing platform, and the person who took it is not the verified guest.
• A self drive rental kept my deposit and stopped responding Your security deposit was not refunded and support does not reply.
• A bike taxi rider texted or video called me after drop off After a bike taxi ride, the rider contacted you on WhatsApp, by text or video call.
• An auto or cab driver abused me after I cancelled and sent messages to my number You cancelled a ride, and the driver called or messaged abuse.
• I got a cash on delivery parcel I never ordered, or someone placed orders in my name A courier brings a parcel you did not order and asks for cash, or orders appear under your name.
• Right after an online order, scammers called with my order details Callers knew what you ordered and asked for payment, an OTP or a 'refund' step.
• I bought from a brand's own website and scammers knew my order After buying directly from a brand, callers quoted your order.
• A home service professional contacted me outside the app, or I am unsure who sees my details You booked a plumber, cleaner or beautician through an app and want to know where your details go.
• The movers app subcontracted my move and I could not get support You booked packers and movers through an app, a different firm turned up, and things went wrong.
• I searched once on a local search app and get calls for months After one enquiry on a local listings site, vendors call you for months.
• After posting on a B2B marketplace, scammers and spam callers reached me Your business listing or buy request on a trade marketplace brought scam calls.
• The hotel insisted on keeping a photocopy of my Aadhaar, or refused me a room over ID A hotel or homestay wanted to photocopy or photograph your full Aadhaar, or turned you away after seeing your ID.
• I found a hidden camera in a homestay, hostel or rented room You found a camera, or a device that looks like one, in a room you rented.
• I searched for my airline or travel refund helpline and the 'agent' took my money A number you found online claimed to be the airline or booking site and took a payment or remote access.
• Someone used my PNR or booking details to cancel or steal my tickets Your booking was cancelled or changed by someone else using the PNR and your name.
• A travel or visa agent kept my passport or misused my documents An agent will not return your passport, or used your documents for something else.
• I viewed one property on a portal and dozens of brokers started calling After one enquiry or a premium plan on a property site, brokers call nonstop.
• Brokers posted my property without asking me Your flat or house appears on a portal, with photos, listed by someone you never authorised.
• How do I get my number off property portals? You want your number removed from portals and broker lists.
• I lost my deposit to a fake rental listing in a WhatsApp group Someone posted a flat, took a token amount or deposit, and vanished.
• My landlord shared my personal details with others Your landlord passed your ID, phone or rent details to brokers, neighbours or strangers.
• A rental or society app leaked user data A rental, flat sharing or society app reported or was accused of a data leak.
• The society will not show me CCTV footage of an incident Something happened to you or your car in the society, and the committee will not share the footage.
• My neighbour's camera records my door A neighbour installed a camera that watches your door or home.
• The society app or guard records every visitor, or the society group shared residents' details Visitor apps record names, numbers and photos, or a residents' group shared phone numbers and flat details.
• My diagnosis seems to have reached advertisers or strangers After a test or visit, you see ads or get calls about your condition.
• The lab sent my test results to my employer's insurer or someone else Your results reached someone you did not authorise.
• After buying medicine online, the pharmacy app will not stop calling An online pharmacy keeps calling and messaging about refills and offers.
• The online lab gave me a wrong report A home collection or app based lab gave a result that turned out to be wrong.
• My spouse or family shared my medical documents without asking A family member passed your reports to relatives, an employer or a court.
• A fake recruiter had my CV from a job portal and asked for a fee A 'recruiter' knew your CV details and asked for registration, training or interview fees.
• A job app 'HR' asked for a deposit or my documents Someone claiming to be HR asked for a security deposit, bank details or ID copies before joining.
• I paid for a premium job portal plan and got scam calls instead of jobs A paid profile boost brought fake recruiters.
• The background check company wants my PF or tax login A verification firm asked for your EPFO or income tax password.
• HR revealed employees' personal details, or my ex employer threatens me using my details HR shared personal data with others, or a former employer uses your details to threaten action.
• My company wants to install tracking on my personal phone Your employer asks you to install device management or location tracking on your own phone.
• After my exam, coaching institutes and admission agents started calling After a board or entrance exam, callers know your roll number, marks or rank.
• An ed-tech sales team pressured my family and seemed to know about my child Sales staff knew your child's class and school, and pushed a course or a loan.
• My child's school posts photos and shares parent numbers The school puts children's photos online or shares parents' numbers in big groups.
• My matrimony profile showed up on other sites or reached strangers Your profile, photos or number appear elsewhere, or strangers contact you.
• A fake profile on a matrimony site cheated me Someone built trust through a matrimony or dating profile, then asked for money.
• I am being blackmailed with an intimate video call Someone recorded or faked an intimate video call and demands money.
• Someone used my PAN or Aadhaar for a GST number, a company or a loan A GST registration, company, loan or tax notice shows up on your PAN or a family member's Aadhaar.
• Stock tip callers know I just opened a demat account Soon after opening a demat account, callers offer tips or advisory plans.
• I was added to a WhatsApp investment group and lost money An 'expert' group showed profits on an app, and you cannot withdraw.
• My gym or salon keeps messaging me or shared my details A gym, salon or fitness app keeps sending offers or passed your number to partners.
• The ticketing platform might hand my details to an organiser or someone else You want to know who sees your name, number or ID when you book event tickets.
• I bought cricket or concert tickets from a site that turned out to be fake You paid for tickets on a lookalike site or a resale post and got nothing.
• Police caught someone selling personal data of crores of Indians. Is mine in it? News reports a gang caught selling personal data in bulk.

Guides by sector

• Internet and broadband providers Home broadband, fibre and Wi-Fi providers: your rights, evidence and how to complain.
• Mobile phone companies Airtel, Jio, Vi, BSNL and others: SIM fraud, KYC misuse, billing, porting and complaints.
• Spam calls, SMS and telemarketing Block marketing, complain within 7 days, and report fraud calls on Chakshu.
• Banks Fraud, unauthorised transactions, data misuse and how to reach the RBI Ombudsman.
• UPI, payment apps and wallets Failed payments, fraud payments, QR and collect request scams, and refunds.
• Digital loans and loan apps Check if a loan app is real, stop harassment of your contacts, and complain.
• Credit reports and credit bureaus Get your free credit report, fix wrong entries and claim Rs 100 a day for delays.
• Insurance companies and agents Policy data leaks, mis-selling calls and claim problems: the IRDAI route.
• Social media and messaging apps Fake profiles, hacked accounts, leaked photos and the Grievance Appellate Committee.
• Data breaches and leaks What to do when a company leaks your data, and what you can demand.
• Hospitals, labs and health apps (including ABHA) Medical records, test reports, health apps and your ABHA health account.
• E-commerce and quick commerce apps Online shopping and 10 minute delivery apps: orders, returns, fake calls and your data.
• Food delivery, ride hailing and gig apps Food and cab apps, drivers and delivery workers: safety, data and complaints.
• Employers, job portals and job offers What your employer can collect, fake job offers, and job portal data.
• Schools, colleges and ed-tech apps (children's data) Children's data, school apps, verifiable parental consent and ed-tech selling.
• Housing societies, CCTV and visitor apps CCTV, visitor logs, resident WhatsApp groups and apps that run society gates.
• Government services and Aadhaar Aadhaar misuse, Government offices, masked Aadhaar, CPGRAMS and RTI.
• Stock brokers and investment apps (SEBI) Trading apps, demat accounts, investment scams and SEBI SCORES.
• Travel: airlines, trains, hotels and booking sites Bookings, ID copies at hotels, Digi Yatra, fake helplines and complaints.
• Dating and matrimony apps Fake profiles, romance scams, sextortion and leaked photos.
• Vehicles: dealers, registration data and car rentals Car dealers, service centres, vehicle lookups, FASTag messages, renewal calls and self drive rentals.
• Property portals, brokers, landlords and rentals Broker calls after one enquiry, listings posted without consent, fake rentals, landlords and hidden cameras.

Twenty sector guides. Each one links to the matching situations in the list above.

Templates, checklists and explainers

• When a platform shares your data with a third party Hosts, drivers, sellers, agents: who answers for a leak.
• DPDP rights request letter (template) A ready letter to ask a company for your data, a correction, erasure or a grievance fix.
• Evidence checklist What to save, and how, before you complain anywhere.
• Where to complain: the escalation ladder Which office to go to first, next and last, by type of problem.
• What the Data Protection Board can and cannot do Powers, limits, and when you can go to it.
• When companies can use your data without consent Legitimate uses under section 7, in plain words.
• Rights after death or incapacity: nominees How to nominate someone, and what they can do.
• Is this a crime or a privacy complaint? A quick triage: police, regulator or company first.

Official helplines and portals

Your DPDP rights in one list

• Know what data a company holds and who it shared it with (section 11).
• Get it corrected, completed, updated or erased (section 12).
• Have a working grievance route, and a reply within the time the company publishes, never more than 90 days (section 13, rule 14).
• Nominate someone (section 14).
• Withdraw consent at any time (section 6(4)).
• Complain to the Data Protection Board after using the company's route (section 13(3)).

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on 13 May 2027 (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.