Section 12: Right to Correction and Erasure of Personal Data
Section 12 gives Data Principals a direct lever over their own data quality and lifespan: the right to have inaccurate data corrected, incomplete data completed, and data erased once it's no longer needed.
Quick summary
What Section 12 says
- Sub-section (1) — a Data Principal has the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent (including under Section 7(a)), in accordance with any requirement or procedure under applicable law.
- Sub-section (2) — on receiving a correction, completion or updating request, the Data Fiduciary shall (a) correct inaccurate or misleading personal data; (b) complete incomplete personal data; and (c) update the personal data.
- Sub-section (3) — a Data Principal shall make an erasure request in the prescribed manner, and upon receiving it, the Data Fiduciary shall erase her personal data unless retention is necessary for the specified purpose or for compliance with applicable law.
Breaking it down
Section 12 covers two related but distinct rights: keeping data accurate (correction/completion/updating) and ending its retention entirely (erasure). Both apply to processing the Data Principal consented to, including the Section 7(a) certain-legitimate-use ground.
- Sub-s. (2)(a)
Correct
Fix inaccurate or misleading data.
- Sub-s. (2)(b)
Complete
Fill in incomplete data.
- Sub-s. (2)(c)
Update
Refresh outdated data.
- Sub-s. (3)
Erase
Delete on request, unless retention is needed for the purpose or by law.
Three separate obligations under correction, not one. Sub-section (2) breaks the correction right into fixing what's wrong (inaccurate or misleading data), filling what's missing (incomplete data), and refreshing what's outdated (updating) — a Fiduciary needs a process that can handle all three, not just error correction.
Erasure isn't unconditional — it mirrors Section 8(7)'s own exceptions. Just as Section 8(7) requires a Fiduciary to proactively erase data once the specified purpose ends, Section 12(3) gives the Data Principal the right to actively request erasure sooner, subject to the same kind of legal-retention exception. A bank required by law to retain KYC records for a set period, for instance, can decline an erasure request to that extent while the retention obligation applies.
This right operates alongside, not instead of, the Fiduciary's own proactive erasure duty. Section 8(7) already requires erasure once a purpose ends, without the Data Principal needing to ask. Section 12(3) matters most where the purpose technically continues but the Data Principal wants their data gone anyway (subject to any lawful retention requirement standing in the way).
Why this section matters
Personal data compliance isn't just about protecting data from misuse — it's also about making sure the data itself is right, and doesn't outlive its purpose. Section 12 puts control of both directly in the Data Principal's hands, rather than leaving accuracy and retention entirely to the Fiduciary's own discretion.
Real-world example
Setu Health, a hospital network with an online patient portal
Two different patients use Setu Health's portal to exercise their Section 12 rights.
- Patient A notices their recorded blood type is wrong due to a data-entry error — they submit a correction request; under sub-section (2)(a), Setu Health must correct the inaccurate record — this one matters enough that Setu Health treats it urgently given the clinical stakes.
- Patient B, who was treated once years ago and has no ongoing relationship with Setu Health, requests full erasure of their record — Setu Health checks whether medical-records retention law requires it to keep the file for a minimum period; if so, under sub-section (3) it can decline erasure to that extent while explaining the legal basis, rather than deleting a record it's required to retain.
Who needs to care about this section
- Data-rights and customer-service teams — need a working process for correction/completion/updating requests, not just erasure requests.
- Data governance teams — need to know, in advance, which datasets are subject to a legal retention requirement, so erasure requests can be evaluated quickly and correctly against sub-section (3)'s exception.
- Healthcare, financial and other regulated sectors — where legal retention obligations most often collide with Data Principal erasure requests.
Common questions
Can a Data Principal force us to delete data we're legally required to keep?
Does the correction right let a Data Principal add new categories of data we didn't originally collect?
Is there a difference between the Fiduciary's own duty to erase data and the Data Principal's right to request erasure?
Related sections
Section 13 — Right of Grievance Redressal
Continue to the next section in sequence.
Read Section 13Section 11 — Right to Access Information About Personal Data
Go back to the previous section.
Read Section 11Chapter III — Rights and Duties of Data Principal
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sections