Right to Erasure
A Data Principal’s right to ask for her personal data to be erased.
This is your right to ask an organisation to delete your personal data, unless it needs to keep it for the stated purpose or because the law requires it.
Meaning of Right to Erasure
After a request, the fiduciary must erase the data unless retention is necessary for the specified purpose or required by law. It should also ask its processors to erase it. Some retention, such as tax records, can lawfully continue, and the person should be told what is kept and why.
Section 12(1) lists erasure among the rights a Data Principal has over personal data she consented to being processed, including under Section 7(a). Section 12(3) says she must make an erasure request in the prescribed manner, and on receiving it the Data Fiduciary shall erase her personal data unless retention is necessary for the specified purpose or for compliance with law. Rule 14 requires fiduciaries to publish how such requests are made and to respond within a period of no more than ninety days.
Erasure is not absolute. Retention can continue where a law demands it. A bank must keep KYC records for the period prescribed under anti-money-laundering rules, a seller must keep tax invoices, and Rule 8 sets minimum log retention of one year. In such cases the fiduciary should erase what it can, keep the rest only for the legal purpose, and explain what remains and why. Section 8(7) separately requires erasure when the purpose is served or consent is withdrawn, without waiting for a request.
Erasure must reach beyond the main database. The fiduciary stays responsible for processors under Section 8(1), so it must instruct them to delete as well, and should address replicas, exports, analytics tables and backup copies on a sensible schedule. Data that is truly unlinked from the person, so that she can no longer be identified by anyone, is a different matter from data that is merely hidden or flagged inactive.
Erasure should not be confused with withdrawal of consent, although they are often linked. Withdrawing consent stops future processing; erasure removes the data held. It also differs from the popular right to be forgotten, which has wider meaning in other jurisdictions, such as delisting from search results. The Indian right is framed as the Data Principal's right to have the fiduciary erase data it holds about her.
Examples of Right to Erasure
A customer closes her account and asks for deletion. The store deletes her profile and marketing data, and keeps invoices for the period tax law requires.
A customer closes her account and asks for deletion. The store removes her profile, wishlist and marketing preferences, keeps invoices for the period tax law requires, and tells her which records remain and until when.
A user asks a lending app to delete her data after repaying a loan. The app erases marketing and device data but keeps KYC and loan records for the period its regulator requires, explaining this in its reply.
A former patient asks to delete her data. The hospital cannot erase clinical records still covered by retention rules, but it removes her from appointment-reminder lists and its research-contact database.
Why Right to Erasure matters
Holding on to data longer than needed is one of the largest sources of avoidable risk. Each extra year of stored customer data increases what an attacker can steal, which links erasure to the security duty and its penalty of up to ₹250 crore, and to the breach-notification penalty of up to ₹200 crore.
For individuals, erasure is how a person leaves a service cleanly, and trust depends on it actually working. A customer who deleted her account and still receives marketing messages loses faith quickly, and may complain to the Board, where failure to honour a valid request falls under the residual penalty of up to ₹50 crore.
How it works in practice
- 1Publish a clear erasure route in the app settings and privacy page, and tell people what happens next: what will be deleted, what must be kept by law, and how long it will take.
- 2Check identity before acting, because wrongful deletion at the request of an impostor is also a harm. Then decide whether any legal retention duty applies by checking a retention schedule maintained by compliance.
- 3Delete across all systems, including processors, search indexes, caches and analytics stores, and ask processors to confirm completion in writing.
- 4Keep legally required records in a restricted archive, separate from live systems, and tag each with the law and date on which it can be deleted.
- 5Confirm to the person what was erased and what was retained, then schedule automated deletion for retained items when their retention ends.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Only deactivating an account. A hidden profile is still stored data, so it is not erasure.
Forgetting processors and backups, so data returns after a restore or turns up at a vendor.
Refusing erasure by citing "legal obligation" without naming the law. State the specific requirement and erase everything else.
Making users email several people to ask. The request route has to be easy to find.
Compliance tips
Create a retention schedule linked to each law, such as tax, KYC and log rules, so you can answer erasure requests quickly.
Automate deletion jobs and test them with sample records every few months.
Include deletion clauses and proof-of-deletion in every processor contract.
Common questions about Right to Erasure
Can I ask a company to delete all my data?
You can ask under Section 12(3), and the fiduciary must erase it unless retention is necessary for the specified purpose or to comply with law. Data that must be kept by law, such as tax or KYC records, can lawfully remain for that period.
Is erasure the same as deleting my account?
Not always. Closing an account may only deactivate it. An erasure request asks the fiduciary to delete the personal data it holds, which should include data in processors' systems. Ask in writing for confirmation of what was deleted and what is retained.
What happens if consent is withdrawn?
Under Section 8(7), the fiduciary must erase personal data once consent is withdrawn or the purpose is served, unless the law requires retention, and must ensure its processors do the same. This applies even where the individual has not made a separate erasure request.