How to Protect Your Privacy Online in India (2026): DPDP Act, Apps and Your Data

Almost every scam in this series starts the same way: someone already had your data. Your number, your name, your Aadhaar, your address, sitting in a leaked database bought and sold for a few paise per record. You can’t undo past leaks, but you can dramatically shrink what’s exposed going forward, and for the first time, Indian law is genuinely on your side.

This is the privacy half of our online safety guide for India: your rights, and the practical habits that limit your footprint.

Your new rights: the DPDP Act, in plain English

India’s Digital Personal Data Protection Act (passed 2023, with detailed rules rolling out through 2025-26) is the country’s first real data-protection law, and it gives ordinary people rights that companies must honour. In plain terms:

The practical upshot: apps and websites now have to let you opt out and delete your data, and there are real penalties for firms that leak or misuse it. You don’t need a lawyer, most services now have a privacy/data-request option in their settings or a grievance officer email they’re legally required to publish.

The habits that shrink your footprint

1. Treat app permissions as the front line

The biggest everyday leak isn’t hackers, it’s apps you willingly gave too much access. A photo-editing app doesn’t need your contacts; a game doesn’t need your location or SMS. On Android: Settings › Privacy › Permission manager, and revoke anything that doesn’t make sense. Our Android security guide covers the exact steps.

2. Guard your Aadhaar and use masked versions

Your Aadhaar number is a master key, don’t share the full number or a plain photocopy casually. Use a masked Aadhaar (downloadable from the UIDAI site, it hides the first 8 digits) wherever full KYC isn’t legally required, and write the purpose and date across any photocopy you must give. You can also lock your Aadhaar biometrics on the mUIDAI app so no one can use them without your unlocking.

3. Give a secondary email and number where you can

Keep one “junk” email and, if practical, a secondary number for shopping sites, contests, Wi-Fi sign-ups and forms. Your primary email and number, tied to your bank and Aadhaar, should be given out sparingly. This alone cuts spam and reduces which databases your real identity ends up in.

4. Lock down your social media

Public profiles are a goldmine for scammers building a convincing story about you. Set Instagram/Facebook to private, hide your birthday and phone number, and think before posting travel plans in real time or photos of new purchases, boarding passes, or documents.

5. Say no to unnecessary KYC and “share to unlock”

Not every shop loyalty program needs your full details. Every extra place your data sits is another database that can leak. When a form asks for more than the service truly needs, leave optional fields blank.

6. Use a password manager and unique passwords

Reusing one password means one leak unlocks everything. A password manager (several are free) generates and remembers unique passwords, so a breach at one site can’t cascade. Pair it with 2FA on important accounts.

Check whether your data has already leaked

You can check if your email appeared in known data breaches using reputable breach-notification services. If it has, change that password everywhere you reused it and enable 2FA. Assume your phone number is already “out there”, which is exactly why the behavioural rules in our UPI fraud and digital arrest guides matter more than trying to keep the number secret.

Kids, families and privacy

Children’s data gets special protection under the DPDP Act, platforms need verifiable parental consent for under-18s. Practically, keep kids’ real names, schools and locations off public posts, use parental controls, and talk to them about not sharing personal details or photos with strangers online. The same “don’t overshare” instinct that protects you protects them.

The realistic mindset

You will never be perfectly private, and chasing that is exhausting. Aim instead for “hard enough to not be worth it.” Shrink your footprint, exercise your DPDP rights when a company mishandles your data, and assume the basics (name, number) may already be exposed, so your safety rests on habits, not secrecy. Combine this with the device settings in our Android security guide and you’ve covered both halves: what’s on your phone, and what’s out in the world.

Frequently asked questions

What rights do I have under India’s DPDP Act?

You can ask companies what data they hold about you, correct wrong data, request deletion when data is no longer needed, withdraw consent, and complain to the company and then the Data Protection Board. Companies must seek clear consent in plain language.

How do I protect my Aadhaar number online?

Use a masked Aadhaar (hides the first 8 digits) where full KYC isn’t legally required, write the purpose and date on any photocopy, and lock your Aadhaar biometrics via the mUIDAI app so they can’t be used without your unlocking.

Which app permissions are the most dangerous to grant?

SMS (enables OTP theft), contacts, location, microphone and storage, when granted to apps that don’t need them. Review them in Settings › Privacy › Permission manager and revoke anything that doesn’t fit the app’s purpose.

How can I check if my data has been leaked?

Use a reputable data-breach notification service to check whether your email appears in known breaches. If it does, change that password everywhere you reused it and turn on two-factor authentication.

Can I ask a company to delete my personal data in India?

Yes. Under the DPDP Act you have a right to erasure, you can request a company delete your personal data when it’s no longer needed for the purpose you gave it. Most services now offer a data-request option or a grievance officer contact.