India Data Removal Guide (2026)
India's Digital Personal Data Protection Act, 2023 (DPDP Act) is being implemented in phases. Until the relevant rights provisions and rules apply, use each provider's current privacy or grievance route. The Act includes scope limits and exclusionsโincluding certain personal data made public under a legal obligationโso a provider request does not automatically amend an official or public source record.
Research status: sources last checked 2026-09-07.
This page is educational orientation, not legal advice. The legal fields below are a research snapshot; eligibility, exemptions, deadlines, penalty rules and broker routes can change. Verify the current statute and regulator guidance before relying on a right or filing a complaint.
This is the Ministry's general DPBI establishment page, not a confirmed individual-complaint filing portal. MeitY separately references a Digital Office Portal for DPBI login and complaint filing, but its official listing does not provide a public filing URL. The Board's complaint mechanism is prescribed under the DPDP Act and Rules, and the relevant commencement provisions are scheduled 18 months after the 13 November 2025 Board-establishment notification.
At a glance
- Governing law
- DPDP Act
- Response deadline
- Current provider routes remain controlling during phased commencement; once Section 13 and Rule 14 apply, a provider grievance system must publish a reasonable response period not exceeding 90 days
- Regulator
- Data Protection Board of India (DPBI)
- Private right of action
- No general DPDP damages right; the Board handles matters within its statutory jurisdiction, while other legal remedies depend on the facts and applicable law
Digital Personal Data Protection Act, 2023 (DPDP Act)
The DPDP Act received assent on 11 August 2023. MeitY's 13 November 2025 commencement notification schedules Sections 3โ5, 7โ17 and related provisions, including Sections 11โ17 rights, 18 months after publication; the final DPDP Rules similarly put Rules 3 and 5โ16 into force 18 months after publication. The Data Protection Board of India was established by a Gazette notification effective 13 November 2025. Once Rule 14 applies, a provider grievance system must publish a reasonable response period not exceeding 90 days. Section 3 also excludes certain personal data made public under a legal obligation, so the Board, commencement dates, exemptions, and source-record rules must be considered before presenting any provider request as a universal deletion right.
Read the full DPDP Actexplainer โScope, penalties, private right of action, enforcement history.
What rights do India residents have?
- โScheduled Section 11 access and processing-information rights; commencement timing and exceptions apply
- โScheduled Section 12 correction and erasure rights; exemptions, source rules, and commencement timing apply
- โScheduled Section 13 grievance-redressal route; first use the provider or Consent Manager and exhaust that opportunity before the Board, subject to commencement and Rule 14 timing
- โScheduled Section 14 nomination right; commencement timing applies
- โConsent withdrawal under Section 6(4), subject to the notified commencement timeline and applicable processing basis
Who holds your data in India?
A removal request in India may involve caller-ID or directory services, company or director filings, land or electoral sources, telecom and marketing providers, or B2B lead platforms. First identify the controller or Data Fiduciary, the exact listing, whether the information is digital personal data, and whether the DPDP Act, a public-data exclusion, another exemption, a sector rule, or a source-record rule applies. A provider-level result does not automatically amend a government, corporate, land, electoral, directory, or other source record or another copy.
Public-record sources brokers scrape
- Company and director filings or other records published under a legal obligation; review source-specific correction and disclosure rules
- Caller-ID, directory, telecom, marketing, and B2B lead providers; use each current privacy, unlisting, or grievance route
- Land, electoral, and other public records; DPDP coverage and source correction depend on the record and its legal publication basis
- Foreign services offering goods or services to people in India; assess the DPDP Act's Section 3(b) connection and the provider's current route
How to remove your data in India
- 1Identify the controller or Data Fiduciary, exact listing, processing basis, and whether the DPDP Act applies. Do not assume every public record or provider copy is subject to erasure.
- 2Use the provider's current privacy, unlisting, or grievance route and preserve the request and response. Section 13 requires exhausting the provider or Consent Manager grievance opportunity before the Board once the provision applies.
- 3Where consent is the processing basis, withdraw consent through the provider's route; withdrawal does not undo prior lawful processing and may not control processing required or authorised by law.
- 4For data made public under a legal obligation or held in an official source record, ask the source custodian about correction and disclosure rules. A site-level request does not amend the source record.
- 5For unresolved issues, review the current official DPBI information and filing instructions. The Board is established, but the applicable commencement rules and any live submission process still control how a matter can be brought.
Generate requests in under 60 seconds
Generate requests for 1,034 US/global broker workflows for $9
What if a company ignores your request?
Consider the Data Protection Board of India (DPBI) information or complaint route above if the controller does not respond or the response is unsatisfactory. This guide records the following penalty orientation: The Schedule's highest listed maximum is โน250 crore for failure to take reasonable security safeguards, with lower maxima for other specified contraventions; the relevant penalty provisions are enacted but scheduled to commence 18 months after the 13 November 2025 Board-establishment notification, not yet operative. The private-action note is: No general DPDP damages right; the Board handles matters within its statutory jurisdiction, while other legal remedies depend on the facts and applicable law. Neither field is an individual award or a promise of enforcement.
Open the Data Protection Board of India (DPBI) information or complaint route โFAQ: India data removal
Can I remove my personal phone number and address from Indian websites under the DPDP Act?+
Section 12 lists correction and erasure rights, but the official commencement notification places Sections 11โ17 18 months after 13 November 2025, and the final Rules place Rules 3โ16 on the same 18-month schedule. Use the provider's current route now and check the commencement date, exemption, processing basis, and the Section 3(c)(ii) exclusion for certain personal data made public under a legal obligation. A provider request does not necessarily alter an official or public source record.
What is the penalty for data brokers violating privacy rights in India?+
The DPDP Act Schedule sets different maximum penalties for specified contraventions. The โน250 crore ceiling applies to failure to take reasonable security safeguards; other listed contraventions have different maxima. The applicable provision, commencement date, facts, and Board process matter, so do not treat that ceiling as an automatic penalty for every data-removal dispute.