---
title: "Social media and messaging apps: your rights and how to complain"
description: "Fake profiles, hacked accounts, leaked photos and the Grievance Appellate Committee. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/social-media/"
canonical: "https://dpdpr.in/rights/social-media/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Social media and messaging apps: your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- Your profile, posts, messages and contacts (depending on the app).
- Phone number, email and device details.
- Location and activity data.

## Your rights under current law

- IT Rules, 2021 as amended on 10 February 2026: the Grievance Officer must acknowledge within 24 hours and resolve within 7 days. Removal requests for unlawful content: 36 hours. Intimate images or impersonation, including morphed images: 2 hours.
- If the platform fails you, appeal to the Grievance Appellate Committee within 30 days.
- Identity theft and cheating by impersonation online are offences under sections 66C and 66D of the IT Act, 2000. Report them on cybercrime.gov.in.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

From 13 May 2027 you can ask a platform what it holds about you and ask for erasure. Children's accounts need verifiable consent of a parent (section 9).

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- Someone opens an account in your name or with your photos.
- Your account is hacked.
- Private photos shared without consent.
- Harassment.

## Evidence to keep

- Profile link (URL) and username of the fake account.
- Screenshots with date and time visible.
- Your report number from the platform.
- Messages sent to your friends by the fake account.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Complain to the app or platform, then the Grievance Appellate Committee

Social media and other online platforms must publish the name and contact of a Grievance Officer. The IT Rules, 2021 (as amended on 10 February 2026) set short time limits.

**Keep this ready before you start:**

- Links (URLs) to the post, profile or account.
- Screenshots with date and time.
- Your own account name, and the complaint number from the platform.

1. Find the platform's Grievance Officer. The rules require the name, contact and complaint method to be shown on the website or app, usually under Help, Legal or Grievance.
2. Send your complaint there. Attach links and screenshots.
3. The Grievance Officer must acknowledge it within 24 hours and resolve it within 7 days.
4. For a request to remove content such as impersonation, privacy invasion or harassment, the limit is 36 hours.
5. For content that shows your private body parts, nudity, sexual acts, or impersonates you (including morphed images), the platform must act within 2 hours of your complaint.
6. If you are not satisfied, or get no reply within 30 days, appeal to the Grievance Appellate Committee within 30 days.
7. Open [gac.gov.in](https://gac.gov.in). Click **Appellant Login (File appeal / View status)**.
8. Agree to the privacy policy, enter your mobile number and the captcha, then click **Send OTP**.
9. Fill the appeal and upload the Grievance Officer's reply or your complaint proof.
10. The GAC order is uploaded on the site. You get an SMS and email. The platform must publish a compliance report.
11. The GAC does not handle money fraud or cybercrime. For those use 1930 or cybercrime.gov.in.

Checked on 1 November 2026 against: [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa), [Grievance Appellate Committee (IT Rules, 2021): FAQ](https://gac.gov.in/CMSData/FAQs).

### File a complaint on cybercrime.gov.in

The National Cyber Crime Reporting Portal takes complaints about online fraud, hacking, fake profiles, harassment and more. Your complaint goes to the police of your State or Union Territory. The screen names below come from the portal's FAQ and the Ministry of Home Affairs citizen manual. The portal can change. If a screen looks different, follow the words on the screen.

**Keep this ready before you start:**

- Date and time of the incident.
- Incident details in your own words. The portal checklist asks for at least 200 characters and no special characters such as # $ @ ^ \* \` ~ | !
- A photo or scan of a national ID (Voter ID, Driving Licence, Passport, PAN or Aadhaar) in .jpg, .jpeg or .png, not more than 5 MB.
- For money fraud: bank or wallet name, 12 digit transaction ID or UTR, date and amount.
- Evidence files such as screenshots, not more than 10 MB each.
- If known: the other person's mobile number, email, bank account, website link or social media handle.

1. Open [cybercrime.gov.in](https://cybercrime.gov.in) in a browser.
2. Click **File a complaint**.
3. Read the message. Tick **I Accept**.
4. Click **Report Other Cyber Crime**. (For sexual content involving women or children, use the women and child section instead.)
5. Type your name in **User Name**. Type your mobile number.
6. Click **Get OTP**. Type the OTP you receive. It is valid for 30 minutes.
7. Fill the security answer. Click **Submit**.
8. In **Incident details**, choose the **Category of complaint**. For money loss choose Online Financial Fraud. For fake profiles or harassment choose Online and Social Media Related Crime.
9. Choose the **Sub-Category** that fits best.
10. Enter the approximate date and time. If you are late, fill **Reason for delay in reporting**.
11. Choose **Where did the incident occur?** (for example a phone call, SMS, WhatsApp, a website or an app).
12. Upload your evidence files.
13. Write what happened in the details box. Say who contacted you, from which number, what they said, what you shared or paid, and when.
14. Click **Save and Next**.
15. Add suspect details if you have them: name, mobile number, bank account, UPI ID or website. Click **Save & Next**.
16. Fill your own details and address. Choose your State, District and Police Station.
17. Upload your ID proof. Click **Save & Preview**.
18. Check everything. Tick **I Agree**. Click **Confirm & Submit**.
19. Write down the **Complaint ID** shown on screen. You also get it by SMS and email. It is a complaint number, not an FIR number.
20. Click **Download PDF** and save the file in a safe folder.
21. To check progress later, log in the same way and click **Check Status**.
22. If you get no action, or are not happy with what the police did, contact the cyber crime grievance officer of your State or Union Territory listed on the portal. You can also visit your local police station with the PDF and ask for an FIR.

Checked on 1 November 2026 against: [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx), [National Cyber Crime Reporting Portal: checklist before filing](https://www.cybercrime.gov.in/Webform/Crime_AuthoLogin.aspx), [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx).

### Use your DPDP rights (from 13 May 2027)

The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections.

**Keep this ready before you start:**

- The company's published method for rights requests. Rule 14 says companies must show it on their website or app.
- The identifier they ask for, such as your username, customer ID or registered mobile number.

1. Find the company's rights or grievance page, or its Data Protection Officer contact.
2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/).
3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)).
4. Save the acknowledgement or ticket number.
5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days.
6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)).
7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it.

Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Grievance Officer, \[platform\] Subject: Impersonation: account \[URL\] uses my name and photos The account \[URL\] uses my name and photos without my consent and is contacting my friends. Proof of my identity and screenshots are attached. Under rule 3(2)(b) of the IT Rules, 2021 please remove it within the time the rules set, and confirm. \[Name\], \[your own profile link\], \[date\]

## Time limits

- Acknowledgement: 24 hours. Resolution: 7 days. Unlawful content removal: 36 hours. Intimate images or impersonation: 2 hours.
- GAC appeal: within 30 days.

## If this happened to you

- [\*\*Someone made a fake profile using my name or photos\*\*An account impersonates you or uses your photos.](https://dpdpr.in/rights/scenarios/fake-social-account/)
- [\*\*A loan app read my contacts and messaged everyone that I am a defaulter\*\*Your friends and family received messages calling you a fraud or defaulter.](https://dpdpr.in/rights/scenarios/loan-app-messaged-contacts/)
- [\*\*A loan app is threatening to send morphed nude photos of me\*\*Agents say they will share edited intimate photos unless you pay.](https://dpdpr.in/rights/scenarios/loan-app-morphed-photos/)
- [\*\*A caller ID app shows my name and details to strangers\*\*People who never had your number see your name, or a wrong or offensive name, when you call.](https://dpdpr.in/rights/scenarios/caller-id-app-shows-my-name/)
- [\*\*I am being blackmailed with an intimate video call\*\*Someone recorded or faked an intimate video call and demands money.](https://dpdpr.in/rights/scenarios/video-call-blackmail/)
- [\*\*I was added to a WhatsApp investment group and lost money\*\*An 'expert' group showed profits on an app, and you cannot withdraw.](https://dpdpr.in/rights/scenarios/whatsapp-investment-group/)

## Official sources

- [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa)
- [Grievance Appellate Committee (IT Rules, 2021): FAQ](https://gac.gov.in/CMSData/FAQs)
- [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)