Made under: DPDP Act, 2023 ss.11–13; IT Act s.43A

Request to a company about your personal data — DPDP Act 2023 and IT Act s.43A

Fill in the blanks

Everything you type here stays in your own browser. Nothing is sent anywhere, nothing is saved, and we never see it. Close the page and it is gone — so print before you close it.

Leave a field empty and a blank line is printed in its place, to be filled in by hand. Printing the empty form and carrying it with you is a perfectly good use of this page.

Name of the company, seller or service provider

Their address (registered office or branch)

Your full name

Exactly as it appears on your Aadhaar or ID.

Your full address

Mobile number

What happened — in your own words

Write it in the order it happened. Do not guess at anything you cannot remember.

What you are asking for

For example: a full refund, a replacement, compensation, the cost of the case — one demand per line, with the amount.

Place (where you sign this)

Today's date

The document

To,
The Grievance Officer / Data Protection Officer
________________
________________

Subject: Request about my personal data — access, correction, erasure and grievance.

Made under: Sections 11, 12 and 13 of the Digital Personal Data Protection Act, 2023 (in force from 13 May 2027, together with the Digital Personal Data Protection Rules, 2025); until then, Section 43A of the Information Technology Act, 2000 and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Sir / Madam,

1. I am ________________, resident of ________________, mobile ________________, email ________________. I am a user / customer of ________________.

2. My grievance, and the personal data it concerns:
________________

3. I request that you:
________________

4. Under the Digital Personal Data Protection Act, 2023 a Data Principal has the right to obtain a summary of the personal data being processed and of the processing (s.11), the right to correction, completion, updating and erasure (s.12), and the right to have a grievance redressed by the Data Fiduciary (s.13); and must first exhaust that grievance redressal before approaching the Data Protection Board of India. Under the Rules a Data Fiduciary must respond within a period not exceeding ninety days.

5. Until those provisions take effect, a body corporate handling sensitive personal data is bound to maintain reasonable security practices (s.43A, Information Technology Act, 2000), and its Grievance Officer must redress a grievance within one month (Rule 5(9), SPDI Rules, 2011).

Please acknowledge this request and reply in writing within the time allowed by law.

Yours faithfully,

________________
________________

Place: ________________
Date: ________________

What to attach

The grievance officer's email or form published on the company's website or app — send it there.
Your account or customer number, and the email or phone linked to it — so they can identify you.
Keep the date you sent it and their acknowledgement; that is what the Board or a court will ask for later.

Legal Drafts