Glossary
What is erasure under DPDP?
Erasure is both a right of the Data Principal and a duty of the Data Fiduciary. Retention required by law is the main limit.
Definition
Erasure is the Data Principal's right under s.12 of the DPDP Act, 2023 to have personal data erased, and the Data Fiduciary's duty under s.8(7) to erase personal data when consent is withdrawn or the purpose is no longer served, unless a law requires retention. The Data Fiduciary must also make its Data Processors erase it.
What it means
Erasure works two ways. A Data Principal can ask for it under s.12, and the Data Fiduciary must erase on its own once consent is withdrawn or the specified purpose is no longer served (s.8(7)).
For the classes in the Third Schedule, Rule 8 treats the purpose as no longer served three years after the Data Principal last approached the fiduciary or exercised rights (or from commencement, whichever is later), with at least 48 hours' notice before erasure. See retention.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.12 | Right to erasure, with correction, completion and updating |
| s.8(7) | Erase on withdrawal or when the purpose is no longer served, unless law requires retention; make processors erase |
| s.6(6) | Stop processing within a reasonable time after withdrawal |
| Rule 8 | Third Schedule classes: three-year period and 48 hours' notice |
| Rule 8(3), Rule 6 | Certain personal data and logs kept for at least one year |
Common misconceptions
- “Erasure on request is absolute.” Retention required by law continues (s.8(7)).
- “Deleting from the main database is enough.” Data Processors must be made to erase too (s.8(7)).
- “The three-year rule applies to everyone.” Rule 8's three-year period applies to the Third Schedule classes only.
Related terms
How long personal data is kept before erasure (s.8(7), Rule 8).
CorrectionCorrecting, completing and updating personal data (s.12).
Data Principal rightsAccess, correction, erasure, grievance redressal and nomination (ss.11 to 14).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
In TruePrivacy
Erasure requests run through Data Principal requests, with identity verification and tasks fanned out to connected systems. Retention rules act on data after a set period, optionally with approval, log each execution and flag items that need a manual purge.
Must a Data Fiduciary always erase data on request?
Not when a law requires it to keep the data. s.8(7) requires erasure on withdrawal of consent or when the purpose is no longer served, unless retention is required by law.
What is the 48 hours' notice in Rule 8?
For the Third Schedule classes, Rule 8 requires at least 48 hours' notice to the Data Principal before personal data is erased under that rule.
Does erasure cover vendors?
Yes. s.8(7) requires the Data Fiduciary to make its Data Processors erase the personal data too.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin