Right to Erasure under the DPDP Act

The right to erasure allows an individual to ask for deletion of their personal data under the Digital Personal Data Protection Act, 2023. The individual is the data principal, while the person determining the purpose and means of processing is the data fiduciary. Erasure is not unconditional: retention may continue where necessary for the specified purpose or compliance with law.

When a data principal may request erasure

Section 12 provides the right to correction, completion, updating and erasure of personal data for whose processing the data principal has previously given consent.

• This expressly includes consent referred to in Section 7(a), which covers personal data voluntarily provided for a specified purpose where the individual has not indicated that they do not consent to its use.
• Under Section 12(3), the individual must submit an erasure request to the data fiduciary in the prescribed manner.
• The provision does not require the individual to establish that the data is inaccurate or that its processing was unlawful before requesting erasure.

When the data fiduciary must erase or may retain data

Under Section 12(3), the data fiduciary must erase the personal data upon receiving the request, unless its retention is necessary for the specified purpose or for compliance with any law.

• The specified purpose is the purpose mentioned in the notice given to the data principal under the Act.
• Necessary retention for a continuing specified purpose can therefore limit an erasure request.
• A legal obligation to retain records can also prevent immediate deletion; the right does not override statutory retention requirements.

Erasure duties beyond an individual request

Section 8(7) separately imposes an erasure duty on the data fiduciary, unless retention is necessary for compliance with law.

• The fiduciary must erase personal data when the data principal withdraws consent, or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier.
• The fiduciary must also cause its data processor to erase personal data made available to that processor.
• Thus, an individual request under Section 12 is not the only trigger for erasure.