How to ask a company: what data do you have on me?
You have signed up on dozens of websites. Each one has some of your personal data — your name, email, phone number, browsing history, maybe more. Under India's data protection law (DPDP), you can ask any company: what data do you have on me?
Here is how to do it, and what to expect.
Step 1: Find the right email address
Go to the company's website. Scroll to the bottom and look for a link to their privacy policy. Inside the privacy policy, look for a "Grievance Officer" or "Data Protection Officer" or "Contact us about privacy" section. That is where you will find the email address to write to.
If you cannot find it, try emailing their general support address. But the privacy/grievance email is better because it goes to the team that is supposed to handle these requests.
Step 2: Use this template
Subject: Data Access Request under DPDP Act
Dear Grievance Officer,
I am writing to request access to all personal data your company holds about me, as is my right under the Digital Personal Data Protection Act, 2023.
My details:
Full name: [Your name]
Email used for registration: [Your email]
Phone number used: [Your phone number, if applicable]
Please share the following:
1. All personal data you hold about me
2. The purposes for which this data is being used
3. The names of any third parties with whom my data has been shared
4. How long you plan to keep my data
I expect a response within 30 days. Please acknowledge receipt of this request.
Thank you,
[Your name]
Copy this template, fill in your details, and send it to the company's grievance officer email.
What to expect
Best case: The company replies within a few days with a clear answer listing your data. Some companies are well-prepared for this.
Common case: The company replies but points you to a different form, a different team, or a different email address. They acknowledge your request but never actually answer the question.
Worst case: The company never replies. Keep your original email as evidence. Under DPDP, how a company responds to your request is itself evidence of their readiness.
We sent these emails to 107 companies. Here is what happened.
Some answered clearly. Others sent us to a different form, a different team, or a different email address. The reply never answered the question. Under DPDP, how a company responds to that email matters — it is evidence of whether they are ready for the law.
Read the full investigation →How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.
Talk to Meridian Bridge Strategy →Your personal data belongs to you. Under DPDP, every company must tell you what they have and delete it if you ask. One email is all it takes.
Get the template email →We investigated 107 Indian company websites. The public report shows what we found.