Can a customer ask us to delete their data under the DPDP Act?
Yes — a Data Principal has the right to request erasure of their personal data. But erasure does not override an obligation to retain records for a purpose required by law. Where a statutory retention duty applies, such as KYC or transaction records in financial services, you may continue to hold that data, and you must be able to explain per record which basis applies and for how long.
The failure mode is refusing requests without being able to justify the refusal. That is worse than either erasing or retaining, because it looks arbitrary.
Erasure also has to be real once it applies. If data survives in a reporting replica, a backup outside its stated window or a processor's system, it has not been erased.
General information about the DPDP Act, not legal advice. Obligations depend on your circumstances.
Related questions
Priya Gupta — Priya writes on compliance operations at ProtectComply, including data principal rights, grievance handling and sector-specific programmes.
Where do you stand under DPDP?
Take the free readiness check and find out in 10 minutes.
Start free readiness check →