Data Erasure
Permanently removing personal data so that it can no longer be used.
Data erasure means permanently removing personal data so that it can no longer be used or recovered in the ordinary course. It has to reach every copy you control, including those held by vendors.
Meaning of Data Erasure
Erasure covers live systems, backups, analytics copies and data held by processors. Where full deletion from backups is not immediately possible, restrict use and delete on the next cycle.
Erasure appears in the Act in two ways. Section 8(7) is the duty that you carry on your own: when consent is withdrawn or the purpose is no longer served, you must erase the data, and cause your Data Processor to erase what it was given, unless retention is necessary for compliance with law. Section 12 is the right that the person exercises: a Data Principal may request erasure of data processed on the basis of consent, and under Section 12(3) the Fiduciary must comply unless retention is necessary for the specified purpose or for legal compliance.
Erasure is broader than pressing delete in an app. The data may sit in production databases, replicas, search indexes, caches, analytics warehouses, log files, exports, email attachments, backups and the systems of processors and sub-processors. A deletion that removes the visible profile but leaves these copies is incomplete. Rule 8 also expects advance warnings for classes covered by the Third Schedule, and the rule on logs means that some security data must be kept for a minimum time even if the profile is erased.
There are lawful limits. Records required by tax law, company law, sectoral regulators or a pending legal claim may be retained, as Section 8(7) and Section 12(3) allow, and Section 17 exempts some processing, such as enforcing a legal right. In those cases the best practice is to delete everything that is not needed, restrict access to what remains and tell the person what you are retaining and the reason.
Technical methods matter. For disks and devices, overwriting or certified wiping can work. For cloud data, cryptographic erasure deletes the encryption keys so the data becomes unreadable. For backups that cannot be edited, a documented approach is to flag erased records so they are not restored and to let backups expire on a short cycle. Anonymisation, if irreversible, also removes data from the Act's scope, but pseudonymised data stays personal data.
Examples of Data Erasure
On account closure, a retailer deletes the profile from the database, asks its email vendor to delete the contact and schedules backup expiry.
A customer closes their account. The retailer deletes the profile and saved addresses, asks its email vendor to delete the contact, keeps invoices that tax law requires and tells the customer so, and the backup expires in the next monthly cycle.
A company deletes the files of unsuccessful candidates a few months after hiring ends, including resumes forwarded by email, interview notes in a shared drive and entries in the applicant tracking tool operated by a vendor.
A user withdraws consent for a savings app. The app stops processing, deletes marketing and behavioural data, retains KYC and transaction records for the regulator's period in a restricted store, and notes the retention basis in its response.
Why Data Erasure matters
Failing to erase when required is a breach of Section 8(7) or Section 12, and the general penalty head allows up to ₹50 crore after Board inquiry. A leftover copy in a forgotten system is also a security risk: if it is later breached, the organisation will have to explain why it still held the data, with up to ₹250 crore exposure for security failures.
Erasure also matters to people. Someone who closes a bank wallet, leaves a job portal or withdraws consent from a lender expects the data to stop circulating. Visible, prompt erasure builds trust, while ignored requests turn into complaints at the grievance desk and then the Board.
How it works in practice
- 1Define what erasure means for each system in your data map: hard delete, anonymise, or restrict until a legal period ends.
- 2Create a request workflow with identity verification, a record of the decision, deadlines and a notice to the person that explains what was erased and what was retained under a legal requirement.
- 3Instruct processors in writing and obtain confirmation of deletion. Contracts should specify deadlines and a certificate or log.
- 4Handle backups explicitly: restrict access, avoid restoring erased records, and let backups expire within a documented window.
- 5Use the right technique for the medium, such as cryptographic erasure in cloud storage and certified wiping for returned devices and laptops.
- 6Keep a minimal erasure log with date, system and result, without storing the erased content, so you can show what happened.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Deleting the user record but leaving copies in analytics tools and vendor systems. Trace and remove the copies.
Refusing erasure by citing "legal requirement" for the entire profile. Only the data a law requires may be kept.
Marking a record as inactive and calling it erased. If the data can still be used or read, it has not been erased.
Failing to confirm vendor deletion in writing.
Compliance tips
Inventory every place a person's data can sit before you design the deletion routine; the data map is the best source.
Write erasure requirements into every new vendor contract, including timeline and evidence.
Test the process quarterly with a dummy profile and check each system for traces.
Explain in your response what has been deleted and what has been kept, so the person is not left guessing.
Common questions about Data Erasure
Does the DPDP Act give a right to erasure?
Yes. Section 12 gives a Data Principal the right to request erasure of personal data processed on consent. The Fiduciary must erase it unless retention is necessary for the specified purpose or for compliance with a law.
Is deleting a user account the same as data erasure?
Not always. Closing an account may only deactivate it. True erasure removes the personal data from live systems, processors and, within a defined cycle, backups, except records you must keep by law.
Do I have to erase data when consent is withdrawn?
Generally yes. Under Section 8(7) you must erase the data when consent is withdrawn or the purpose is served, unless the law requires retention. Under Section 6(6) you must also stop processing, and ensure your processors do the same.
Can I keep a copy of erased data for legal safety?
Only if a law requires it or it is necessary for a purpose that remains valid, such as a pending legal claim. A general wish to be safe is not enough. Keep the minimum, restrict access and document the basis.