What they may do · DPDP §6(4)
Revoking consent in DigiLocker, and what DigiLocker does with your data
Short answer
To cut an app off from your documents, use DigiLocker’s My Consent dashboard. The National e-Governance Division, which runs DigiLocker, says it shows which apps can reach your documents and lets you cancel that access at any time with a single click. We could not confirm the exact menu path, and it may differ between the app and the website.
What revoking can’t undo: NeGD says a revoked app can’t fetch anything new. A copy it already took — your Aadhaar, a driving licence, a marksheet — sits in that company’s own systems, so ask that company directly. If an app told you to revoke its existing consent and sign in again, this is where: revoke it, then sign in through that app and approve access when DigiLocker asks.
Want the whole account gone instead? DigiLocker’s Terms of Use say you can delete it at any time — here is who to ask. Checked against NeGD’s DigiLocker page and DigiLocker’s Terms of Use on 14 October 2026.
A 2017-era government policy predating the DPDP Act: it says it won't sell your data, but permits sharing with other organisations on a good-faith legal, fraud or safety belief — and says nothing at all about retention, AI or advertising.
Who to write to at DigiLocker
The only contact DigiLocker publishes is a general inbox rather than a named officer. It is still their published contact, so a request goes there — expect a support reply before a legal one.
- Published address
- support@digitallocker.gov.in
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
DigiLocker’s own policy says “The personal and usage information, as collected may be shared with other Organizations, if Ministry of Electronics and Information Technology have a good faith belief that access, use, preservation or disclosure of the information is reasonably necessary to: Meet any applicable law, regulation, legal process or enforceable Government request; Detect, prevent or otherwise address fraud, security or technical issues as well as investigation of potential violations; Protect against harm to the rights, property or safety of DigiLocker System, other users or the public as required or permitted by law.”
Our summary personal and usage information may be shared with other organisations where MeitY forms a good-faith belief that disclosure is reasonably necessary for legal compliance, fraud/security handling, or protecting rights and safety.
What the policy does not mention
These are uses DigiLocker’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Builds an advertising profile of you
- Follows you onto other websites and apps
- Keeps your records long-term
- Processes your face or other biometrics
- Trains AI models on your content
DigiLocker is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · built in India for the DPDP Act
Questions
How do I revoke consent I gave an app in DigiLocker?
Use DigiLocker's My Consent dashboard. The National e-Governance Division, which runs DigiLocker, says it shows which apps can reach your documents and lets you cancel that access at any time with a single click. The menu path may differ between the app and the website.
Does revoking consent in DigiLocker delete what the app already fetched?
Not by itself. NeGD says a revoked app can't fetch anything new from your account. A copy it already took sits in that company's own systems, where DigiLocker cannot reach it, so ask that company for erasure directly.
What does DigiLocker do with my personal data?
According to DigiLocker's own privacy policy, read on 2026-08-14, it discloses 1 of the six uses we track: shares your data with partners.
Can I withdraw my consent from DigiLocker?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Every use above is one DigiLocker declared in its own published privacy policy, which we
read on 2026-08-14. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy