Right to Erasure
The "Right to be Forgotten" — deleting data when it is no longer needed.
🎯 Learning Objectives
- ▸ Understand the scope of the right to erasure
- ▸ Analyze the exceptions where erasure can be denied
- ▸ Learn how to request deletion
The Right to be Forgotten
The right to erasure, also known as the right to be forgotten, is one of the most powerful rights under the DPDPA. It means you can ask a company to delete your data when they no longer need it.
For example, if you close your e-commerce account, you can request the platform to delete your address, phone number, and purchase history.
When Can Erasure Be Denied?
There are exceptions. A company can refuse to delete your data if retention is necessary for:
- • Compliance with a legal obligation (e.g., tax records must be kept for 8 years).
- • Defending legal claims (e.g., if you are in a dispute with the company).
- • Investigation of a crime by a government agency.
You cannot use the right to erasure to ask a bank to delete your loan records while the loan is still active. The purpose is not fulfilled yet.
📖 Glossary
- Right to Erasure
- The right to have personal data deleted by a Data Fiduciary upon request, subject to certain conditions.
- Right to be Forgotten
- A broader concept that includes erasure and the delinking of data from search engines.
🔑 Key Takeaways
- You can request deletion when the purpose is served.
- You can request deletion after withdrawing consent.
- The company can refuse if retention is required by law.
📚 Further Reading
- DPDPA Section 12 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...