Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

Use this from 13 May 2027, when sections 11 to 14 start. Before that, you can still send it as a request; many companies will answer, but they are not yet bound by these sections.

How to send it

Find the company's rights or grievance page. Rule 14(1) requires it to publish how to make a request and what identifier it needs.
Use that method (form, email or app). If there is none, email the grievance officer named in the privacy policy.
Tick only the boxes you need. Delete the rest.
Send it. Save the acknowledgement or ticket number and the date.
Set a reminder for the reply date the company publishes, and at most 90 days.
If there is no reply or a bad reply, send one reminder quoting your ticket number.
Then complain to the Data Protection Board using the method it publishes.

The letter

To: Grievance Officer / Data Protection Officer
[Company name]
[Address or official email from its privacy page]

Subject: Request under the Digital Personal Data Protection Act, 2023: [access / correction / erasure / grievance / nomination / withdrawal of consent]

I am [full name]. My identifier with you is [customer ID / username / registered mobile number].

Please do the following:
[ ] Give me a summary of the personal data about me that you process, and what you do with it (section 11(1)(a)).
[ ] Give me the names of all other companies and processors you shared my data with, and what you shared (section 11(1)(b)).
[ ] Correct / complete / update this data: [what is wrong and what it should say] (section 12(2)).
[ ] Erase my personal data, unless a law requires you to keep it. If you keep any, tell me which law (section 12(3)).
[ ] I withdraw my consent for [purpose, for example marketing calls] (section 6(4)).
[ ] Record [name, relation, contact] as my nominee (section 14).
[ ] Treat this as a grievance about [describe] (section 13).

Please acknowledge this request and reply within the period you publish under rule 14(3) of the DPDP Rules, 2025, which cannot be more than 90 days.

[Name]
[Mobile]
[Date]

Attachments: [ID proof only if you ask for it; earlier complaint numbers]

Things to know

Access and correction rights cover data you gave with consent or voluntarily (section 7(a)). They may not cover data used under other legitimate uses, such as employment (section 7(i)). See when consent is not needed.
Section 15 says you must not file false or frivolous complaints; the Schedule allows a penalty of up to Rs 10,000 for breaching your duties.
Companies may refuse erasure where a law requires them to keep records, such as banking or tax laws.