Request to a company about your personal data — DPDP Act 2023 and IT Act s.43A

दस्तावेज़

To,
The Grievance Officer / Data Protection Officer
________________
________________

Subject: Request about my personal data — access, correction, erasure and grievance.

Made under: Sections 11, 12 and 13 of the Digital Personal Data Protection Act, 2023 (in force from 13 May 2027, together with the Digital Personal Data Protection Rules, 2025); until then, Section 43A of the Information Technology Act, 2000 and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Sir / Madam,

1. I am ________________, resident of ________________, mobile ________________, email ________________. I am a user / customer of ________________.

2. My grievance, and the personal data it concerns:
________________

3. I request that you:
________________

4. Under the Digital Personal Data Protection Act, 2023 a Data Principal has the right to obtain a summary of the personal data being processed and of the processing (s.11), the right to correction, completion, updating and erasure (s.12), and the right to have a grievance redressed by the Data Fiduciary (s.13); and must first exhaust that grievance redressal before approaching the Data Protection Board of India. Under the Rules a Data Fiduciary must respond within a period not exceeding ninety days.

5. Until those provisions take effect, a body corporate handling sensitive personal data is bound to maintain reasonable security practices (s.43A, Information Technology Act, 2000), and its Grievance Officer must redress a grievance within one month (Rule 5(9), SPDI Rules, 2011).

Please acknowledge this request and reply in writing within the time allowed by law.

Yours faithfully,

________________
________________

Place: ________________
Date: ________________