How to Exercise Your Right to be Forgotten (RTBF) in India
• The Mechanism: Requires a formal request to the Data Fiduciary (the entity holding your data) followed by escalation to the Data Protection Board (DPB) if ignored.
• The Scope: Applies to data provided based on consent or voluntarily, where the original purpose of processing has been served or consent is withdrawn.
The Right to be Forgotten (RTBF) is no longer a judicial theory in India; it is a statutory right under the DPDP Act. This guide outlines the technical and legal steps to ensure your personal data is erased from digital platforms when it is no longer necessary or authorized.
Step 1: Identify the Data Fiduciary
Determine which entity is processing your data. Under the DPDP Act, every platform must provide a clear Privacy Notice and designate a Grievance Redressal Officer (GRO) or a Data Protection Officer (DPO). Check the "Privacy Policy" or "Terms of Service" page of the website or app to find their contact details.
Step 2: Submit a Formal Erasure Request
Draft a formal request citing Section 12(3) of the DPDP Act, 2023. Clearly specify the data you want erased and the reason (e.g., withdrawal of consent or fulfillment of purpose).
• Template Hint: "Under Section 12 of the DPDP Act, I hereby withdraw my consent for the processing of [specific data] and request its immediate erasure from your servers."
• Delivery: Send this via the platform’s registered grievance email to ensure a digital paper trail.
Step 3: Utilize a Consent Manager
As of 2026, the MeitY-authorized Consent Manager framework is operational. These are interoperable platforms that allow you to view, manage, and withdraw consent across multiple services (Fiduciaries) from a single dashboard. Register with a licensed Consent Manager to automate the withdrawal process.
Step 4: Escalate to the Data Protection Board (DPB)
If the Data Fiduciary fails to respond or resolve your grievance within the prescribed timeline (usually 7-30 days), file a complaint with the Data Protection Board of India.
• Portal: Use the DPBI Digital Office (accessible via India Stack) to lodge an online complaint. The Board has the power to issue binding directions and impose penalties for non-compliance.
Step 5: Judicial Recourse for Court Records
For the removal of past court judgments or criminal records from search engines (specific RTBF cases), the DPB may have limited jurisdiction. In such instances, you must file a writ petition in the relevant High Court or the Supreme Court, citing your Right to Privacy under Article 21.
• DPBI: Data Protection Board of India Official Portal
• National Cyber Crime Portal: Report Misuse of Personal Data
Comments ()