How to Handle a DPDP Data Deletion Request: Step by Step

The short answer

When a user asks you to delete their data under India’s DPDP Act, you must erase it, and make your vendors erase it, unless the law or the purpose you collected it for still requires you to keep it. You then confirm back to the user. The duty comes from Section 12 and Section 8(7), and applies from 13 May 2027.

What the law says

• Section 12(3): on a request for erasure, the Data Fiduciary must erase the personal data unless retaining it is necessary for the specified purpose or for compliance with any law.
• Section 8(7): data must be erased once the user withdraws consent or the purpose is no longer being served, and the Data Fiduciary must cause its Data Processors to erase it too.
• Rule 8(3): personal data, traffic data and processing logs must be kept for at least one year from processing, even if an account is deleted.
• Section 13 and Rule 14(3): you must offer a grievance route and publish how long you take to respond, within a period not exceeding 90 days.

Step-by-step process

1. Give people an easy way to ask

Put a “Delete my data” option where users already manage their account, and in your privacy notice. Section 5 requires your notice to explain how to exercise rights. A self-service rights portal is easier to run than an inbox.

2. Confirm who is asking

Check the request comes from the account holder, for example through a logged-in session or a one-time code to the registered email or phone. Do not ask for more data than you need to verify them.

3. Find every copy

List where that person’s data lives: your main database, CRM, email tool, analytics, support desk, backups and any vendor you share it with. A data map makes this fast.

4. Decide what you must keep

Some records must stay. Examples:

• tax and invoice records you are required to keep under other laws,
• logs you must keep for at least one year under Rule 8(3),
• data needed for an open dispute or legal claim.

Keep only what is required, restrict access to it, and note why.

5. Erase, and tell your processors

Delete or irreversibly anonymise everything else. Then send the request to every Data Processor that holds the data, as Section 8(7) requires. Read more on what your vendors must do.

6. Reply to the user

Confirm what you deleted and, if anything was kept, what and why. Stay within the response time you published under Rule 14(3).

7. Keep a record

Log the request, the checks, what was erased, what was kept and when you replied. Under Section 6(10) the burden of proof sits with you.

Withdrawal is not the same as deletion

When someone withdraws consent under Section 6(4), you must stop processing for that purpose and, under Section 8(7), erase data that is no longer needed. A deletion request goes further: it asks you to remove the data altogether, subject to legal retention.

Penalties

Failing to meet rights and erasure duties falls under the Board’s general cap of up to ₹50 crore in the Schedule. Not taking reasonable security safeguards to prevent a breach is a separate breach, under Section 8(5), with a cap of up to ₹250 crore.

How ConsentPlix helps

ConsentPlix gives users a self-service portal for access, correction, erasure and grievances under Sections 11 to 14, tracks every request against your deadline, and sends signed webhooks so your systems can erase data automatically. See plans.

Checked against Act No. 22 of 2023 and the DPDP Rules 2025, as of October 2026.