Every day, you hand over personal data—to shop, to sign up, to book, and to pay. The Digital Personal Data Protection Act gives you a set of rights over what happens to that data next.
Here is what you can expect, and what you can ask for.
1. Purpose Limitation
Your data should be used only for the purpose explained to you.
2. Data Minimisation
Only personal data necessary for that purpose should be collected.
3. Clear and Informed Consent
Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.
4. Right to Refuse
You may refuse unnecessary data collection or consent for an unrelated purpose.
5. Right to Withdraw Consent
Withdrawing consent should be as easy as giving it.
6. Right to Access
You may request a summary of your personal data and how it is being processed.
7. Data-Sharing Transparency
You may ask who received your data and what was shared with them.
8. Correction and Updating
You may seek correction of inaccurate data and completion or updating of your records.
9. Erasure
You may seek deletion when the purpose has ended or consent is withdrawn, unless the data is still needed for the original purpose or its retention is required by law.
10. Grievance Redressal
You may raise a grievance with the organisation and subsequently approach the Data Protection Board.
11. Security and Breach Notification
You are entitled to have your data protected by the organisation and to be informed when it is breached.
12. Right to Nominate
You may nominate another individual to exercise your rights in the event of death or incapacity.
This post explains the framework in general terms and is not legal advice. Where something turns on your specific situation, take advice on the facts.