Featured Articles

DPDP Act: What Happens When Customers Demand Data Deletion?

Article: DPDP Compliance

What happens when a customer asks your company to delete their personal information? Can you simply remove their account, or must you track down every copy of their data across emails, databases, servers and third-party platforms?

Imagine a customer who has closed their account with your company. They send a formal request asking you to delete their personal information.

Your customer support team marks the account as closed. The CRM record is removed. The request appears resolved.

But what about their contact details stored in email archives? Their payment records in financial systems? Their information backed up on company servers? Or the personal data shared with an external service provider?

The account may be deleted. But has the personal data actually disappeared?

This is precisely the kind of challenge that India's Digital Personal Data Protection (DPDP) Act, 2023 seeks to address.

What Is the Right to Erasure Under the DPDP Act?

The DPDP Act recognises an individual's right to request the erasure of their personal data under Section 12.

Under this provision, a Data Principal can request the deletion of personal data for which they have previously provided consent, including consent under certain legitimate uses specified in the Act.

Upon receiving an erasure request, the Data Fiduciary must erase the relevant personal data unless retaining it is necessary:

• To fulfil the specified purpose for which the data is being processed.
• To comply with any applicable law.

In simple terms, companies cannot continue retaining personal information without a valid reason. However, they must also respect legal record-retention obligations.

This makes the right to erasure more than an account-deletion feature. It requires organisations to understand where personal data is stored, why it is retained and when it can be safely removed.

What Happens When a Customer Requests Data Deletion?

A data deletion request should trigger an organised process within the company, not just a support-ticket closure. Here are five important stages businesses should consider.

1. Verify the Customer's Identity

Before deleting any personal information, the organisation must establish that the request comes from the relevant Data Principal or an authorised representative.

Without proper verification, someone could potentially request the deletion of another person's information.

Companies should have a documented process for identifying the requester using appropriate account identifiers or verification methods without collecting unnecessary additional personal information.

2. Locate Every Copy of Personal Data

This is where many organisations face their biggest challenge. Personal data and personally identifiable information (PII) may be scattered across multiple systems, including:

• Customer Relationship Management (CRM) platforms.
• Email servers and communication archives.
• Databases and cloud storage.
• Employee and customer management systems.
• Third-party applications and service providers.
• Backup and archival environments.

A company cannot make an informed deletion decision if it does not know where the information exists. Without proper data discovery and mapping, even a genuine deletion request can leave personal information unaccounted for.

3. Check Whether the Data Must Be Retained

Not every deletion request means every record must disappear immediately.

For example, a customer may request the deletion of their account, but the company may still need to retain certain transaction records to comply with applicable financial, tax or other legal requirements.

Section 12 recognises these legal retention exceptions. The organisation should therefore distinguish between:

• Data that can be erased because its processing purpose has ended.
• Data that must be retained to fulfil an applicable legal obligation.
• Data that remains necessary for a specified purpose.

Any retained information should not be treated as permission for unrestricted future use.

4. Coordinate Deletion Across Systems and Third Parties

Deleting information from the main customer database is not necessarily enough.

If the company has shared personal data with a Data Processor, such as a cloud hosting provider or an external service platform, it must account for that processing relationship.

The Data Fiduciary should establish appropriate instructions, contractual controls and verification procedures to ensure that deletion obligations are properly addressed across relevant systems.

Organisations must also understand how their backup and archival environments handle deletion, including when information can be permanently erased under applicable retention requirements.

5. Record the Deletion and Close the Request

A deletion request should have a clear audit trail. Companies should maintain appropriate records of:

• When the request was received.
• How the requester's identity was verified.
• Which systems and data repositories were reviewed.
• Which information was erased.
• What information was retained and the reason for retention.
• Whether relevant Data Processors were instructed to take action.

This documentation helps demonstrate accountability and makes future compliance reviews more reliable.

Does the DPDP Act Allow Companies to Retain Personal Data?

Yes, but only where the applicable legal conditions are met.

Section 8(7) also requires a Data Fiduciary to erase personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with law.

The DPDP Rules, 2025 provide additional clarity on certain retention and erasure requirements. For specified classes of Data Fiduciaries and purposes, Rule 8 provides defined periods after which personal data must be erased if the individual has not interacted with the organisation or exercised their rights. It also provides for advance notification at least 48 hours before such scheduled erasure.

Separately, Rule 8(3) requires certain personal data and associated processing logs to be retained for at least one year for specified security purposes, subject to applicable legal requirements.

The key takeaway: Data retention must be justified, documented and controlled. Keeping everything indefinitely is not a responsible data protection strategy.

Is Your Company's IT Infrastructure Ready for a Data Deletion Request?

A company may have a privacy policy explaining its commitment to data protection. But can its IT infrastructure actually support a customer's deletion request?

Consider these important questions:

• Do you have complete visibility of the personal data and PII stored across your organisation?
• Can you identify customer information across databases, email systems, endpoints and cloud environments?
• Do you have a documented data retention and secure erasure policy?
• Can you identify third-party service providers that process customer information?
• Can you demonstrate that deletion requests have been properly handled and recorded?

If the answer to these questions is unclear, your organisation may have significant data governance and compliance gaps. Don't wait until a customer asks for their data to be deleted to discover where it is stored.

Build data visibility. Strengthen your security controls. Prepare your organisation for DPDP compliance.