It’s finally happening: Indian companies can no longer legally ignore your "delete my account" emails.
We all know the struggle. You try to delete an old account from some random shopping site, and they make you jump through a dozen hoops, send an email to a dead inbox, and then they still keep sending you promotional texts three years later.
Well, the Digital Personal Data Protection (DPDP) Rules are officially changing the game.
Under the new law, your privacy is no longer a corporate suggestion; it’s a statutory right. When you submit what is legally called data subject requests (asking a company to show you what data they have, fix wrong info, or completely erase you), the clock starts ticking immediately.
Companies now have a strict maximum of 90 days to completely resolve your request. If they ignore you past day 90? They are breaking the law and face fines up to ₹250 crore.
Also, if they get hacked? They have exactly 72 hours to tell you and the government about the breach. No more sweeping security disasters under the rug for months.
Behind the scenes, tech departments are panicking. For a long time, companies kept our data scattered across messy servers and spreadsheets. To actually meet these new legal deadlines (which are being fully enforced by May 2027), businesses are having to buy serious automation software, like RuleExpert, just to track down and securely delete our digital footprints across all their third-party vendors.
It’s about time our digital boundaries were actually enforced. Read the full blog:
