The Right to be Forgotten: A Guide to Data Erasure under India’s DPDP Act

India’s Digital Personal Data Protection (DPDP) Act, 2023, grants you the legal authority to demand that companies delete your personal data. Whether it's an old shopping profile or data shared with a fintech app, "Data Fiduciaries" are now required by law to wipe your records once their purpose is served. This guide outlines the specific steps to enforce your right to be forgotten.

As the government moves toward stricter AI regulations to ensure user safety, understanding how to manage your data at the source is the first step in digital self-defense.

Step 1: Identifying the Data Fiduciary

Before you can request erasure, you must identify who holds your data. Under the DPDP Act, any entity that decides the "purpose and means" of processing your personal data is a Data Fiduciary. This includes e-commerce platforms, banks, and even government apps. You have the right to ask for a summary of the personal data being processed and the identities of all other entities with whom your data has been shared.

Step 2: Issuing a Formal Request for Erasure

While many apps have a "Delete Account" button, the DPDP Act provides a stronger legal lever. You should issue a formal request to the Data Fiduciary’s designated Data Protection Officer (DPO). Your request should state that you are withdrawing consent for processing and that the data is no longer necessary for the original purpose (e.g., after a service contract has ended). The law requires the Fiduciary to delete the data unless its retention is necessary for a legal purpose.

Step 3: Escalation to the Data Protection Board (DPB)

If the Fiduciary fails to respond within the stipulated time or refuses to delete your data without a valid legal reason, you can escalate the matter to the Data Protection Board of India. The Board has the power to inquire into complaints and impose penalties on companies that violate your digital rights. Keep a record of your initial request and any correspondence with the company as evidence for your complaint.

BharatLens Deduction

Deleting data is technically difficult when records are scattered across distributed cloud servers and AI training sets. BharatLens deduces that the current DPDP framework lacks a "Real-Time Verification" mechanism. While a company may claim your data is deleted, you have no way to verify its removal from their backup servers or their machine-learning models. A scientific approach to digital rights would involve the government mandating "Erasure Certificates" - digitally signed proofs that an entry has been purged from all primary and secondary databases. Until such technical transparency is mandated, your best defense is "Data Minimalism": only provide what is essential, and revoke consent the moment a transaction is complete.