Can companies misuse my personal data?

No. Under Digital Personal Data Protection Act 2023, companies need your consent to collect and process data. You have the right to access, correct, and erase your data.

The Digital Personal Data Protection Act 2023 establishes a comprehensive framework for personal data protection in India. Companies (called Data Fiduciaries) must obtain your free, specific, informed, and unambiguous consent before collecting or processing your personal data. You have the right to: access your data held by any company, request correction of inaccurate data, request erasure of your data, and nominate someone to exercise these rights. Companies must use data only for the stated purpose and delete it when the purpose is fulfilled. Under IT Act Section 43A, companies handling sensitive personal data must implement reasonable security practices. Violations can result in penalties up to Rs. 250 crore under the DPDP Act.

• Digital Personal Data Protection Act 2023
• IT Act — Section 43A (Compensation for failure to protect data)
• Article 21 (Right to Privacy as interpreted in Puttaswamy)