The DPDP Act 2023, Explained: What Is Scheduled and What You Can Do Now

India spent more than five years debating a data-protection law. On 11 August 2023, the Digital Personal Data Protection Act, 2023 (the DPDP Act) became law. Its provisions have phased commencement dates, so it is important not to present every right in the Act as already enforceable.

This post explains, in plain language, what the law gives you and how ScamSafe uses it on your behalf.

Why this law matters

Before the DPDP Act, there was no single law that said a company must delete your data when you ask. Your phone number, email, address and spending habits could be collected, copied, aggregated and sold with almost no recourse. The DPDP Act changes the default: your data is yours, and companies process it only under conditions the law defines.

The Act is now moving from paper to practice. The DPDP Rules were notified on 13 November 2025, setting phased compliance deadlines that turn the 2023 Act's principles into concrete day-to-day obligations for businesses.

The rights that actually help you

Three rights do most of the heavy lifting when you want to reduce your exposure to spam, fraud calls and scams:

1. The Right to Erasure (Section 12)

Section 12 contains the right to erasure, but the Government's 13 November 2025 commencement notification schedules sections 11–17, including Section 12, for eighteen months after publication. For September 2026, ScamSafe does not describe Section 12 as a currently enforceable demand. You may still use an organisation's own privacy, account-deletion, unlisting, or grievance process; which legal or contractual route applies depends on the organisation and circumstances.

2. The Right to Withdraw Consent (Section 6)

The Act contains withdrawal-of-consent requirements, with phased commencement. In the meantime, use the withdrawal or preference process the organisation actually provides and retain a record of your request.

3. The Right to Access and Correction

You can ask what personal data an organisation holds about you and have inaccurate data corrected. Knowing what a company holds is often the first step to deciding what to delete.

What to do now

Start with the organisation's published account, privacy, unlisting, or grievance route. Keep the request, date, recipient and any reply. A company response is not proof of deletion, and silence does not by itself prove a legal breach. For a question about an applicable legal route or deadline, seek qualified advice for your circumstances.

How ScamSafe uses the DPDP Act for you

ScamSafe can help you organise source-attributed findings and prepare a case only when the evidence and recipient route are eligible. A prepared or submitted request is not a deletion outcome. The dashboard must show recorded states and supporting evidence rather than infer a legal conclusion or removal result.

The bottom line: use the privacy and unlisting routes that are available today, read commencement dates carefully, and keep evidence of every action. You can check your exposure to review source-attributed findings without treating a possible match as proof.