People's rights under the DPDP Act
Withdrawal, the rights people have under India's DPDP Act, the 90 day limit for answering, and the extra rules for children.
People can withdraw consent, ask what you hold, have it corrected or erased, and complain. Children get extra protection.
Not legal advice
This page is a summary, not legal advice. It leaves out detail and exceptions, and the law may change. Read the Act and the Rules, and ask your own counsel.
Withdrawal#
A person may withdraw consent at any time. Withdrawing must be as simple as giving consent was (section 6(4)). Withdrawal does not make the earlier processing unlawful (section 6(5)).
Within a reasonable time you must stop processing, and make your Data Processors stop. The exception is processing that a law requires or allows without consent (section 6(6)).
How the product helps. A person can withdraw from the privacy button on your site, the consent portal or the hosted request page. Each withdrawal is recorded, and a consent.withdrawn webhook tells your systems. Telling your own vendors is your step. See Ways people send a rights request and Receive webhooks.
The rights#
| Right | Where |
|---|---|
| A summary of their personal data and what you do with it, and who you shared it with | Section 11 |
| Correction, completion, updating and erasure | Section 12 |
| A way to raise a grievance with you, before going to the Board | Section 13 |
| To nominate someone to use their rights if they die or lose capacity | Section 14 |
As we read sections 11 and 12, the first two are written for data a person gave with consent or voluntarily. Ask your counsel how they apply to data you process on another basis.
What you publish and how fast you answer#
You must publish how to make a request. You also publish which identifier, such as a username, you need to find the person (Rule 14(1)). You must publish who answers questions, and name them in every reply (Rule 9).
Grievances must be answered within a period you publish, of at most 90 days (Rule 14(3)). The Government's explainer of November 2025 describes the same 90 days for access, correction, updating and erasure requests.
How the product helps. The hosted request page takes every type of request, including grievance and nomination. Each one is tracked against a deadline that is never longer than 90 days for people in India. Access, erasure and withdrawal are carried out in one step. See Handle a request.
A parent, a lawful guardian or a nominee can also ask for someone else. Your team confirms their authority first.
Children#
A child is anyone under 18. Before you process a child's personal data, you need the verifiable consent of a parent or lawful guardian (section 9(1), Rule 10). You have to check that the person giving it is an identifiable adult. You may use details you already hold, details they give you, or a virtual token from an authorised entity.
You must not track children, monitor their behaviour or direct targeted advertising at them. You must not process their data in a way likely to harm their well-being (section 9(2) and 9(3)). Rule 12 and the Fourth Schedule exempt some classes of business and some purposes, each within its own conditions.
How the product helps. Your server records a child's consent together with who the guardian is and how you verified them. For a child, marketing and sale or sharing purposes are always stored as refused. Analytics, personalisation and sensitive-data purposes are refused too, unless the purpose names a Fourth Schedule entry that covers it.
Verifying the parent or guardian is your step. The product does not check anyone's age or identity. See Record consent from your server.
Persons with disability#
For a person with disability who has a lawful guardian, you need the guardian's verifiable consent. You also check that the guardian was properly appointed (Rule 11).
An example#
Meera Iyer asks Kaveri Stores to erase her data on the hosted request page. The shop emails her a confirmation link, and she confirms the request is hers. A support agent opens the request and chooses Erase and complete. The shop's server then receives subject.erased and deletes its own copy of her data.