Section 12: Right to Correction and Erasure of Personal Data

Statutory Text (Official Gazette)

(1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.

(2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal:

• (a) correct the inaccurate or misleading personal data;
• (b) complete the incomplete personal data; and
• (c) update the personal data.

(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.

What Section 12 Means in Plain English

Section 12 grants individuals control over their digital footprint in two critical ways:

1. Accuracy and correction: If your database stores incorrect, outdated, or incomplete data about an individual, you must correct or update it upon receiving their request.
2. Right to erasure (Deletion): When an individual asks to delete their data, you must permanently purge their records from your primary databases, cache layers, and downstream processors, unless:
   • The data is still strictly required to fulfill the active service (e.g. delivering an active order).
   • A specific Indian law mandates retention (e.g., tax records under the Income Tax Act, KYC records under RBI guidelines, or transaction logs under PMLA).

Engineering Checklist

• Hard deletion & anonymization pipelines: Build automated deletion APIs that remove records across production databases, backups, search indexes (Elasticsearch/Algolia), and data lakes.
• Data processor cascade: Ensure that an erasure request in your app triggers automated webhooks to external tools (HubSpot, Segment, Intercom) to erase the user there as well.
• Statutory retention exemptions: Maintain an automated retention tagging system to protect records that must legally be retained for accounting or regulatory audits.