• Right to Access: Individuals have the right to access the personal data that organizations hold about them. They can request information about the data's processing and its purpose.

• Right to Rectification: Individuals can request corrections to inaccurate, outdated, or incomplete data held by organizations.

• Right to Erasure (Right to be Forgotten): The Act grants individuals the right to request the deletion of their personal data under specific conditions, such as when the data is no longer needed for the purpose it was collected.

• Right to Data Portability: Individuals can request that their personal data be transferred to another service provider, making it easier to switch between services without losing their data.

• Right to Object: Individuals can object to the processing of their personal data for certain purposes, such as direct marketing or profiling.

• Explicit Consent: Organizations must obtain clear, informed, and explicit consent from individuals before collecting or processing their personal data. Consent must be freely given, specific, and unambiguous.

• Revocation of Consent: Individuals have the right to withdraw their consent at any time, and organizations must stop processing the data once consent is revoked.

• Purpose Limitation: Personal data should only be collected for specific, legitimate purposes and cannot be used for any purposes beyond what was originally stated to the individual.

• Data Minimization: Organizations are required to collect only the minimum amount of data necessary to achieve the purpose for which it was collected.

• Data Security: The Act mandates that organizations implement appropriate technical and organizational measures to ensure the security and confidentiality of personal data. This includes preventing unauthorized access, loss, or misuse of data.

• Privacy by Design: The Act encourages the integration of privacy and data protection features into the design of processes, systems, and services from the outset, ensuring privacy is maintained throughout the data lifecycle.

• Regular Audits: Organizations must conduct regular data protection audits and assessments to ensure compliance with the provisions of the Act and identify any vulnerabilities or breaches.

• Classification of Sensitive Data: The DPDP Act identifies certain types of data as “sensitive personal data,” such as financial information, health data, biometric data, which requires higher levels of protection.

• Stronger Consent for Sensitive Data: The collection and processing of sensitive data require stronger and more explicit consent from the individual, as well as additional safeguards.