DPDP: Can Indian Customers Demand Data Deletion?

DPDP: Can Indian Customers Demand Data Deletion?

Yes, under India's Digital Personal Data Protection Act (DPDP Act), Indian customers (referred to as 'Data Principals') can demand the deletion of their personal data. This is enshrined in Section 13(1) of the Act, which grants Data Principals the 'Right to Erasure'. Businesses (referred to as 'Data Fiduciaries') must acknowledge and act on these requests, provided certain conditions are met.

Sushant Pasumarty, founder of Meridian Bridge Strategy (MBS), emphasizes that this right is not absolute. Data Fiduciaries can deny deletion requests if the data is necessary for a legal obligation, for exercising a legal claim, or for specific public interest purposes. Understanding these nuances is critical for compliance.

Current Enforcement Reality: What to Expect Now

While the DPDP Act is enacted, the specific rules and regulations for its implementation are still being formulated. This means that while the right to data deletion exists on paper, the exact mechanisms for making and enforcing these requests are not yet fully operational. The government has indicated a phased rollout.

Despite the lack of immediate strict enforcement, businesses should proactively prepare. Establishing internal processes for data deletion requests now will position your organization for smoother compliance when the rules are finalized. Sushant Pasumarty recommends preparing for the eventual full enforcement.

What Your Business Must Do to Prepare for Data Deletion Requests

Preparing for the Right to Erasure involves several key steps:

1. Identify Personal Data: Map out every instance where your business collects, stores, processes, or shares personal data. This forms the foundation for managing deletion requests.
2. Establish Deletion Protocols: Develop clear internal policies and procedures for receiving, verifying, and fulfilling data deletion requests. This includes timelines for response.
3. Implement Technical Capabilities: Ensure your IT systems and databases can actually delete data effectively and comprehensively across all storage locations. This often requires significant technical work.
4. Train Your Teams: Educate customer service, HR, IT, and legal teams on the DPDP Act's requirements, specifically regarding data principal rights and how to handle such requests.
5. Review Third-Party Agreements: If you share personal data with third-party vendors or processors, ensure your contracts obligate them to comply with deletion requests you receive.

Cost of DPDP Compliance: MBS Productized Services

Meridian Bridge Strategy (MBS) offers structured services to help Indian businesses achieve DPDP compliance, including readiness for data deletion requests. Here's a breakdown of the typical costs:

When Should Your Business Start DPDP Preparation?

The time to start preparing for DPDP compliance, including the Right to Erasure, is now. While full enforcement rules are pending, proactive measures allow businesses to integrate compliance into their operational fabric rather than reacting under pressure. Delaying preparation can lead to higher costs, operational disruption, and potential penalties once the Act is fully implemented.

Sushant Pasumarty recommends initiating a DPDP Readiness Audit within the next 3-6 months to accurately gauge your organization's current standing and identify critical gaps.

Next Step: Assess Your DPDP Readiness

Understanding the Right to Erasure is one piece of the DPDP puzzle. To ensure comprehensive compliance, your business needs a holistic strategy. Begin by understanding your current data landscape and identifying where personal data resides. MBS offers initial consultations to help Indian business founders, CXOs, CTOs, HR heads, and compliance officers understand their specific DPDP requirements.