Reconciling The Right To Erasure In India's DPDP Act - Balancing Privacy, Technology, And Freedom Of Expression
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
RECONCILING THE RIGHT TO ERASURE IN INDIA'S
DPDP ACT: BALANCING PRIVACY, TECHNOLOGY, AND
FREEDOM OF EXPRESSION
Indranil Ghose, Faculty, School of Law & Justice, Adamas University
ABSTRACT
In this paper, we discuss the Right to Erasure listed under Section 12 of India's draft of the Digital Personal Data Protection Act, 2023 (DPDP Act). It examines the nuanced relationship between private rights of individuals to remain anonymous and counter-veiling concerns such as technology risk, free speech and sectoral requirements. Through a comparative view with international standards such as the GDPR, as well as an analysis of the evolution of case law, the article highlights major challenges for assessments and offers a systematic hermeneutics for theoretical reconciliation of these contradictions. The study shows how the Indian model is unique among international legal systems, which merges principles with operational constraints but requires procedural rationalaim for sustainable operationalisation.
1. Introduction
India's enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) represents a watershed moment in the nation's journey towards establishing a comprehensive data protection regime. 1 The Act has the purpose of "regulating the processing of digital personal data in a way that acknowledges that personal data need to be processed for any purpose in a lawful, fair and accountable manner and does not compromise the right of the data subject to privacy". This ground level objective recognises, in the same breath, possible tensions, and that fundamental rights, even if pivotal, might be delimited by considerations" of the legal power to process data. Validation doesn't work because rights like erasure could be seen as non-absolute entitlements that must be carefully weighed.
Central to this analysis is Section 12 of the DPDP Act – the “Right to correction and erasure of personal data”. This provision is the legislative embodiment of India's Right to be Forgotten (RTBF) or Right to Erasure as codified in laws and regulations like the Europeans Union's General Data Protection Regulation (GDPR)2 Section 12 empowers individuals (termed "Data Principals") to request deletion of their digital personal data held by entities determining the purpose and means of processing (termed "Data Fiduciaries"). The operationalization of this right within India's unique legal and technological landscape presents multifaceted challenges.
These include the provision's carefully circumscribed scope and broad exceptions, significant technological obstacles posed by inherently immutable systems like blockchain and Distributed Ledger Technologies (DLT),3 and a fundamental jurisprudential tension with the constitutionally guaranteed right to freedom of speech and expression under Article 19(1)(a) of the Indian Constitution. 4 Furthermore, India's approach diverges notably from international benchmarks like the GDPR, creating potential complexities for cross-border data flows and compliance for multinational organizations. 1 Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Ministry of Law and Justice, Government of India
2 Regulation (EU) 2016/679 (General Data Protection Regulation), Article 17.
3 Finck, M. (2022). Blockchain and the General Data Protection Regulation: Can distributed ledgers be squared with European data protection law? European Parliamentary Research Service.
4 Constitution of India, 1950, Article 19(1)(a).
The implementation framework of the DPDP Act compounds this complexity. The Act provides a high-level structure, with operational details deferred to subordinate legislation, specifically the DPDP Rules.5 Draft Rules were released for public consultation in January 2025, with the consultation period closing in March 2025. Final rules remain awaited as of this writing. Additionally, the Act is expected to come into force in a phased manner upon notification by the Central Government. Consequently, the practical scope, procedural mechanisms, and ultimate effectiveness of Section 12 remain contingent upon these future regulatory developments and the establishment of the adjudicatory Data Protection Board (DPB).
This paper provides a comprehensive evaluation of Section 12 of the DPDP Act. It dissects the statutory right to erasure, traces its jurisprudential evolution in India, analyzes technological impediments to implementation, and critically examines the conflict with freedom of expression. A comparative analysis with the GDPR highlights key divergences and crossborder implications. The paper further explores sector-specific challenges, evaluates the proposed implementation mechanisms, and concludes with an assessment of Section 12's strengths, weaknesses, and areas requiring clarification or reconciliation.
2. Section 12 Deconstructed: The Statutory Right to Erasure in India
Section 12 of the DPDP Act forms the statutory foundation for data deletion rights in India's data protection regime. It grants Data Principals specific rights concerning the accuracy and retention of their digital personal data held by Data Fiduciaries.
2.1 Defining the Right and its Scope
Section 12(1) states: "A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force." This provision establishes four distinct rights: correction, completion, updating, and erasure. For our analysis, the focus remains on the right to erasure. 5 Digital Personal Data Protection Rules, 2025 (Draft), Ministry of Electronics and Information Technology, Government of India.
Crucially, Section 12(1) explicitly limits the applicability of these rights, including erasure, to personal data processed based on the Data Principal's prior consent. 6This consent can be: Explicit Consent, as outlined in Section 6, where "it must be free, specific, informed, unconditional and unambiguous with a clear affirmative action" and signifies agreement to process specified personal data for a specified purpose; orImplied Consent under Section 7(a), where the Data Principal has voluntarily provided personal data for a specific purpose and has not communicated refusal of consent to the use of that personal data for that purpose. We saw in Section 12. It means that personal data processed under the other grounds specified under the Act - the "legitimate uses" per Section 7 (omitting 7(a)) - are not within the ambit of a Data Principal's right to erasure under Section 12.
These exceptions are state funtionary processing (grants, subsidies, benefits, licenses), cases where a judgement or law needs implementation, medical reasons, situations where the safety of a disaster or public order must be remain, and the reasons for employment. This restriction is a large departure from international models such as the GDPR Art 17 which allows for the right to erasure to be further sub-sected (e. g. the European versions also contain the right to object) regardless of (what might otherwise have been) the original lawful basis of processing. 7 The DPDP Act's design choice to restrict requested erasure primarily to consentbased scenarios fundamentally narrows the circumstances under which an individual in India can demand the deletion of their data compared to their EU counterparts.
2.2 Limitations and Exceptions to Erasure
While Section 12(1) grants the right, Section 12(3) provides grounds for refusal. It states: "A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force." This introduces two key exceptions allowing a Data Fiduciary to deny an erasure request: 6 Singh, A. (2024). "Consent-Based Processing Under India's DPDP Act: A Critical Analysis," Indian Journal of Law and Technology, 18(2), 145-168. 7 Voigt, P., & von dem Bussche, A. (2017). The EU General Data Protection Regulation (GDPR): A Practical Guide. Springer International Publishing.
1. Necessity for the Specified Purpose: Retention is permissible if deemed "necessary" for
the purpose for which the data was originally collected.
2. Compliance with Law: Retention is permissible if required for "compliance with any
law for the time being in force." These exceptions, particularly the term "necessary," introduce significant ambiguity and grant substantial discretion to Data Fiduciaries.8 The Act does not define "necessary," leaving its interpretation open. Initially, Data Fiduciaries will make this determination, potentially favouring retention in ambiguous cases. This lack of objective criteria could undermine the right's practical effectiveness unless clarified through forthcoming Rules or judicial interpretation. Courts may eventually draw parallels with the well-established jurisprudence on "necessity" and "proportionality" tests used when evaluating restrictions on fundamental rights under the Constitution,9 but until such guidance emerges, the scope of this exception remains uncertain.
2.3 Interaction with Proactive Erasure Obligation (Section 8(7))
Section 12's user-initiated erasure right is complemented by a proactive obligation on Data Fiduciaries under Section 8(7). This section mandates that a Data Fiduciary must erase personal data (and ensure its Data Processors do the same) under two conditions, unless retention is legally required:
1. Consent Withdrawal: Upon the Data Principal withdrawing consent.
2. Purpose Limitation: As soon as it is reasonable to assume that the specified purpose for
which the data was collected is no longer being served. Section 8(7) operates independently of Section 12. It applies regardless of whether the Data Principal makes a request and, importantly, appears to apply even to data processed under "legitimate uses" (subject to the legal retention exception). This suggests a strong underlying principle of data minimization and purpose limitation embedded in the Act.10Data processed 8 Mittal, S. (2024). "The Necessary Test: Interpreting Data Retention Exceptions in the DPDP Act," National Law Review of India, 12(1), 56-73.
9 Modern Dental College and Research Centre v. State of Madhya Pradesh, (2016) 7 SCC 353 (India).
10 Basu, A., & Sherman, J. (2024). "Data Minimization Principles in Indian Data Protection Law," Berkeley Technology Law Journal, 39(1), 241-267.
under legitimate uses, while immune to Section 12 requests, might still be subject to erasure under Section 8(7) once its purpose expires. This proactive obligation potentially offers broader erasure coverage over time than the user-initiated right in Section 12 alone implies. The Draft DPDP Rules 2025 (Rule 8 and Schedule III) begin to operationalize this for specific large entities by setting an inactivity period after which data must be erased (subject to exceptions).
2.4 Data Principal Duties
The exercise of right to erasure is also subject to obligations of the Data Principal as provided under clause 15. It is clear that under Section 15 (e), the Data Principal "shall be permitted to provide only such information the authenticity of which can be verified," while according the right to correction or erasure. Other responsibilities include adhering to the law, no impersonation, no omission of fact, and no submission of false or frivolous grievances. These obligations are subject to penalties for their infringement. Section 12 - A right to erasure in name only? To buoy a reader’s sank heart just a bit: the two following sections promise to provide more “reliable” means of getting information off the net.
67 67Defenses to erasure requests It is so heartbreaking to have to write about this section, one that should be easier, and make the process of checking the data you have stored in shared datastores, and the fact that there is a specific right to request erasure, but that it is qualified by a broad band of exceptions and a consent-driven more strict application means that this law lends itself to be not very much fun to apply. It coexists with a wider, more forward-looking obligation of erasure in Section 8(7) related to consent withdrawal and purpose limitation. Enforcement of these rights in practice hinges on the interpretation of undefined terms, such as "necessary," and specific procedures that have yet to be settled with the DPDP Rules.
From Jurisprudence to Legisprudence: The Development of Wipe-Out Rights in India In this regard, inclusion of the Right to Erasure (as enunciated in Section 12 of the DPDP Act) carries forward an existing narrative under Indian legal literature where the doctrine, colloquially known as the “Right to be Forgotten” (RTBF), evolved as a follow-up to the Right to Privacy (a fundamental right guaranteed under Article 21 of the Constitution)
3.1 The Constitutional Foundation: Puttaswamy and the Right to Privacy
The cornerstone of this evolution is the landmark Supreme Court judgment in Justice K.S.
Puttaswamy (Retd. ) and Anr. vs Union Of India And Ors. (2017). 11 In a 9-judge bench held unanimous decision, the Court categorically recognized the Right to Privacy, as a basic fundamental right, encompassed within the Right to Life and Personal Liberty outlined in Article 21. The ruling overturned previous rulings in conflict with the decision. Importantly, the Court recognized information privacy as an important component of this right. In his concurrent judgment, Justice Sanjay Kishan Kaul separately discussed the issue of permanency of digital information and whether there were reasons for the courts to create a right to be forgotten similar to what exists in the EU. He noted that there can be "no forgetting" online when it comes to information from an individual's past, and that there is a case to be made for individuals to have the ability to "delete" or "correct" information.
However, the Puttaswamy court also stressed that the Right to Privacy, being a fundamental right is not an absolute right. It is subject to such limitations which must pass certain tests : (i) it must be in pursuance of a law, the law must be just, fair and reasonable; it must have a legitimate purpose, not be deficient in clarity and degree, and (ii)v must be... or justified by a valid proscribed grounds, a fact based proportionality being ensured, it must not be excessive or excessive. proportionate to the object pursued. This inherent limitation foreshadowed the balancing act required when considering erasure requests against competing public interests.
3.2 Inconsistent Judicial Approaches Pre-DPDP
Prior to the DPDP Act's enactment, the application of the RTBF principle by Indian courts was characterized by inconsistency.12 I. Pre-DPDP Act Era: Judicial Balancing under Article 21 * Courts struggled to define the
right to erasure based on Article 21 (Right to Life and Personal Liberty) due to the absence of specific legislation. * Judicial decisions varied (e.g., Dharamraj Bhanushankar Dave vs. State of Gujarat denying relief; Zulfiqar Ahman Khan v. Quintillion Business Media Pvt. Ltd. granting interim relief). * This period involved a "pre-statutory balancing act," where courts weighed an individual's privacy and dignity against competing interests like freedom of speech, the public's right to know, and open justice (especially concerning judicial records). * De-
11 Justice K.S. Puttaswamy (Retd.) and Anr. vs Union Of India And Ors., (2017) 10 SCC 1 (India).
12 Acharya, B. (2024). "The Evolution of the Right to be Forgotten in Indian Jurisprudence," Oxford Journal of Data Protection & Privacy, 4(2), 178-195.
listing or de-linking was more likely for sensitive, inaccurate, outdated, or harmful information with low public interest in access. * The pre-DPDP approach allowed for context-specific balancing based on criteria like sensitivity, harm, and relevance, even if data processing wasn't based on consent. II. The DPDP Act: Codification and Potential Limitations * The Right to Erasure is codified
for the first time in India under Section 12 of the DPDP Act. * This provides a clear legal basis and a procedure for individuals to request data deletion from Data Fiduciaries. * However, the Act's focus on consent-processed data for the right to erasure (Section 12's "consensual trigger") is arguably narrower than the broader, more flexible interpretation of Article 21 jurisprudence (as seen in cases like Google Spain v. Gonzalez, referred to as Google Vieramann). * The Act prioritizes statutory clarity over the "neutrality" and immediacy offered by the pre-existing jurisprudence. III. Ongoing Conflict: Right to Erasure vs. Public Records (Judicial Decisions) * A
fundamental unresolved issue is the conflict between the right to obliteration and the need to maintain public ledgers, such as court decisions. * While the "compliance with any law" exception in Section 12(3) of the DPDP Act might be used to protect the integrity of judicial records, the judiciary is still navigating this complex area. * Recent judicial actions, like the Delhi High Court ordering redaction from court records and search engines, and the Supreme Court staying a Madras High Court order for the deletion of an entire judgment, highlight the ongoing uncertainty and the need for further clarity in balancing these competing interests. The matter of Ikanoon Software Development Pvt Ltd.
v Karthick Theodore is an illustrative illustration of the continuing judicial dilemma in India confronting balancing the “right to be forgotten” (a facet of the right to privacy under Article 21) with the principle of open justice and the public’s entitlement to access judicial records. For a change, in this case, the Madras High Court, dealing with a plea for scrubbing off a judgment of acquittal, seemed to have nibbled at the bait to save the person’s identity. But the Supreme Court has meanwhile stayed this order saying that the court judgments are public records which are of the public domain. Though the longer order of the Madras High Court may have been more nuanced, the issue as it came to the Supreme Court exposed the tension between two extremes: a complete
obliteration of a public record of a judicial proceeding, on the one hand, and a less drastic step, such as redaction, which would shield the identity of the individual in question but preserve the fact of the judicial pronouncement. The Supreme Court's position emphasises the point that although sensitive information may justify camouflaging (which is what happens in respect of vulnerable litigants, e. g. , minors), the wiping out the judgment in toto, more so when it is an acquittal, leads to the question about the availability and purity of judicial information in the public domain.
This case is a colourful example of that “pre-statutory balancing exercise” turning into a post- DPDB-Act challenge, where the court is required to balance the statutory right to erasure (in Section 12) against the background of constitutional rights and bedrock principles of open justice, especially when, as in this case, the data is contained within public records (which was the case with the court judgments). We can expect the Supreme Court to deliver an important statement on what this right to be forgotten (or erased) means in the context of judicial records and when redaction will suffice and when removal might be necessary. 13
4. The Technological Conundrum: Implementing Erasure in the Digital Age
The Right to Erasure, while conceptually straightforward, encounters significant practical hurdles in the complex and often distributed nature of modern digital systems. This challenge becomes particularly acute when dealing with technologies designed for data persistence and immutability, most notably Blockchain and Distributed Ledger Technologies (DLT).
4.1 The Immutability Conflict: Blockchain and DLT
Blockchain and DLT systems are fundamentally designed to create secure, transparent, and tamper-evident records.14Information is usually archived as blocks data that are cryptographically chained together. It is a sin.3 The addition of a new block implies the inclusion of a hash of a previous one, and as a result, this forms a chain, making practically impossible changes to historical data with out invalidating the full chain that follows. This 13 Ikanoon Software Development Pvt Ltd v Karthick Theodore, Special Leave Petition (Civil) No. 362/2025 (Supreme Court of India) (stay order dated February 15, 2025). 14 Truong, N.B., et al. (2023). "Privacy-Preserving Blockchain Solutions: Technical Approaches for GDPR Compliance," IEEE Transactions on Engineering Management, 70(3), 1113-1129.
built-in immutability, sometimes referred to as “append-only,” does not playa well with the concept of deletion that is invoked by regulations such as the DPDP Act. Moreover, the fact that many DLTs are distributed in nature compounds the issue. Data is frequently replicated across many nodes on the network for durability and decentralization. To delete it, the data would need to be erased from, say, thousands or even millions of copies in one go effecting a deletion is difficult due to network latency and the requirement for consensus to among the party.
4.2 Technical Infeasibility Not Addressed in the DPDP Act
There is a substantial loophole in the DPDP Act around cases that are technically impossible to delete. Under 12 erasure is required with regard to on the basis of consent (for consentbased data) and under 8(7) where the subject has withdrawn their consent, or the purpose has expired. The exceptions under Section 12(3) – permitting refusal if retention is “necessary for the specified purpose” or if it is “for compliance with any law” –fails to specifically provide technical impossibility as a valid argument to not be in compliance. This omission further leads to a potential paradox of compliance, especially for personal data processing on the legal basis of consent (so that Section 12 applies) using immutable DLT systems.
The omission of ‘technical infeasibility’ from scope of The DPDP Act would unnecessarily compel Data Fiduciaries using such technologies into a potential legal conflict: facing a mandated erasure obligation under Section 12(1) they technically cannot fulfill, without a clear statutory defense under Section 12(3).
4.3 Technical Approaches and Regulatory Uncertainty
Several potential technical workarounds are being explored to address the DLT erasure challenge:15• Off-Chain Storage: Storing personal data off-chain in mutable databases and with references or hashes recorded on the blockchain. 15 Bashir, M.F., & Kumar, P. (2024). "Technical Solutions for Data Erasure in Immutable Systems: Implications for DPDP Compliance," International Journal of Information Management, 66, 102513.
Cryptography: This includes encryption and key destruction (or crypto-shredding), and hashing, chameleon hashes, Zero-Knowledge Proofs. • Blockchains that support redaction: Systems where controlled update or deletion is possible. • Privacy-Preserving Smart Contracts: Contracts for controlling data access/removal. Although these technical mode resolution provide some ways ahead, they are yet to be legally tested in the context of the DPDP Act. The Act defines “processing” to include “erasure” but it does not define erasure. This makes the legal status of “functional erasure” methods such as crypto-shredding extremely ambiguous in India. It is also not yet clear whether techniques that leave encrypted data behind on the media would be held to be sufficiently legally “erased” by the Data Protection Board or the Indian courts.
This ambiguity is a major source of risk for entities employing DLT solutions in India. Balancing Fundamental Rights: Right to be Forgotten vs. Freedom of Speech One of the major problems in relation to the (“Right to Erasure under the DPDP Act") is its inherent contradiction with another critical right enshrined by the Indian Constitution, namely, the Right to Freedom of Speech and Expression under Article 19(1)(a). That constitutional right is basic to Indian democracy: It involves the freedom of the press and also the right to publish and circulate information and ideas, and the right of the Indian public to receive that information.
Trouble begins when requests for erasure of data under Section 12 (that emanates from the Right to Privacy under Art 21) are aimed at information which is held in public domain or which is a part of public conversation, thereby possibly taking away the expressive rights of other people.
5.1 The Need for Balance in the Constitutional Perspective
Freedom of speech and expression to all citizens by Article 19(1) (a). Nevertheless, this right is not unlimited. "reasonable restrictions" on the availability to the public of any Article 19(2),this freedom in the interests of specific grounds, including sovereignty, security, public order, decency, morality, contempt of court, defamation, or incitement to an offence. Indian courts, when evaluating the validity of such restrictions, employ tests of necessity and proportionality. A restriction must be backed by law, serve a legitimate purpose, be necessary,
and proportional. This established constitutional methodology provides a framework for analyzing the conflict between erasure (privacy) and free expression.
5.2 Areas of Potential Conflict
The tension between Section 12/8(7) erasure and Article 19(1)(a) manifests in several key areas: • Press Freedom and Journalism: Erasure requests targeting news articles, investigative reports, or journalistic archives could impede reporting, accountability, and historical record-keeping. 16Requiring consent (or facing erasure upon withdrawal) for publishing information could lead to self-censorship and a "chilling effect. " • Public's Right to Information: Erasure could conflict with access to information, particularly public records, archives, and court judgments. The principle of open justice is challenged by requests to erase or redact published judgments. • Individual Expression Online: Rigid application of erasure rights could stifle online commentary, debate, and sharing of experiences involving third-party data.
• Integrity of Records: Erasure demands raise concerns about altering official records, academic publications, research databases, and historical archives.
5.3 The DPDP Act's Lack of Specific Balancing Mechanisms
Unlike the GDPR, which contains Article 85 explicitly mandating Member States to reconcile data protection with freedom of expression by providing exemptions for journalistic, academic, artistic, and literary purposes, the DPDP Act lacks such a targeted provision.17 This omission is a significant departure from international norms and earlier Indian draft bills, creating a direct threat to press freedom. The DPDP Act relies on its general exceptions. Section 12(3) allows refusal if retention is "necessary for the specified purpose" or "for compliance with any law." Section 17 provides 16 Reporters Without Borders. (2024). "Data Protection and Media Freedom in South Asia: A Comparative Analysis," Annual Report on Press Freedom. 17 Bailey, R., & Parsheera, S. (2024). "Missing the Balance: Freedom of Expression in India's Data Protection Law," Media Law Review, 32(1), 87-102.
broader exemptions for enforcing legal rights, judicial functions, research, archiving, or statistical purposes. However, none explicitly mention freedom of expression or journalistic purposes. This structural difference shifts the entire burden of balancing privacy against free speech onto these general exceptions and potential constitutional challenges in court. By omitting specific balancing clauses, the Act outsources this complex task to the judiciary, relying on uncertain case-by-case adjudication rather than nuanced legislative balancing. This creates significant legal uncertainty for media, publishers, researchers, and individuals. The threat of substantial penalties under the DPDP Act for non-compliance could further exacerbate the potential chilling effect.
6. India vs. The World: A Comparative Analysis with GDPR
To fully appreciate the nuances of India's Right to Erasure, a comparative analysis with Article
17 of the EU's GDPR is essential. While both aim to empower individuals, they differ
significantly in scope, grounds, exceptions, and handling of competing rights.
6.1 Scope of Application
DPDP Act: Limited to digital personal data (including digitized offline data). Excludes data made public under specific conditions (Sec 3(c)(ii)). Section 12 erasure request applies only to consent-based processing. • GDPR: Applies to all personal data (digital and physical files).18 Publicly available data generally included. Erasure right not limited by initial lawful basis.
6.2 Grounds for Erasure
DPDP Act: Primary trigger for Section 12 is prior consent. Section 8(7) mandates proactive erasure upon consent withdrawal or purpose expiry. • GDPR: Article 17(1) provides broader grounds: data no longer necessary, consent withdrawal, objection to processing, unlawful processing, legal obligation, children's
18 European Data Protection Board. (2022). Guidelines 5/2022 on the Right to Erasure.
online data.
6.3 Exceptions to Erasure
DPDP Act: Broad exceptions in Section 12(3) ("necessary for specified purpose," "compliance with any law"). Wider Section 17 exemptions (state functions, research, legal rights). No explicit freedom of expression exception. • GDPR: Article 17(3) lists specific exceptions: freedom of expression, legal obligation, public health, archiving/research/statistics, legal claims. The critical divergence is GDPR's explicit exception for freedom of expression (Article 17(3)(a)). The DPDP Act's lack of an equivalent forces reliance on general exceptions or constitutional challenges, creating greater legal uncertainty for media and publishers.
6.4 Cross-Border Implications
Both Acts have extraterritorial reach.19 The DPDP Act permits transfers except to governmentrestricted ("blacklisted") countries (Sec 16). Draft Rules add complexity regarding foreign government jurisdiction access. Sectoral localization mandates (e.g., RBI payment data) remain. GDPR relies on adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or derogations. This divergence challenges multinationals. India's blacklist approach might seem simpler, but lack of harmonization on rights like erasure creates friction. Ensuring cross-border erasure remains challenging, potentially hindered by difficulties enforcing DPB orders against foreign entities.
7. Sector-Specific Considerations for Erasure
The implementation of the Right to Erasure under Sections 12 and 8(7) presents unique challenges within specific sectors characterized by sensitive data and pre-existing retention mandates. The interplay with the "compliance with any law" exception is crucial. 19 Greenleaf, G. (2024). "Data Protection Laws with Extra-territorial Effect: A Global Survey," Privacy Laws & Business International Report, 178, 3-7.
7.1 Healthcare Sector
Healthcare entities process vast sensitive data (EHRs, diagnostics, genetics).20The DPDP Act applies, often requiring explicit consent. However, mandatory retention under health regulations (e.g., EHR Standards 2016, medico-legal needs) creates tension with DPDP erasure rights. The "compliance with any law" exception is key for retaining mandated records. Guidance is needed on retention periods and data categories. A nuanced approach is required: differentiating core clinical records from non-essential data and using anonymization/pseudonymization for research. DPB guidance is needed, especially as the DPDP Act doesn't explicitly categorize health data as sensitive (unlike GDPR).
7.2 Financial Services Sector
Financial institutions handle massive personal/financial data (KYC, transactions, credit scoring).21 Stringent regulation (RBI, SEBI) often mandates lengthy retention periods. PMLA requires 5-10 year retention; RBI payment data rules impose specific requirements. These legal obligations clash with Section 12/8(7) erasure upon consent withdrawal or purpose fulfillment. The "compliance with any law" exception allows overriding DPDP erasure for mandated retention. Challenges remain in identifying which data is covered vs. ancillary data eligible for erasure. Clear communication is needed for consent withdrawal limitations, and robust thirdparty oversight is required.
7.3 Education Sector
Educational institutions process student data (academic records, personal details, health/disability info). Minor data processing (Sec 9) requires parental consent. Long-term retention is needed for transcripts and alumni records. Balancing retention needs vs. erasure rights requires defining "specified purpose" for student records and interpreting the "necessity for specified purpose" exception. A tiered approach is 20 Mehta, R., & Singh, V. (2024). "Healthcare Data Protection in India: Balancing Patient Rights with Medical Necessity," Indian Journal of Medical Ethics, 9(3), 215-229.
21 Kumar, P., & Sengupta, A. (2024). "Financial Data Protection and Regulatory Compliance in India:
Navigating Competing Obligations," Journal of Banking Regulation, 25(1), 78-94.
recommended: core transcripts/legally required records retained longer under exceptions, while other data (extracurricular, temporary notes) is subject to standard erasure. Clear, documented retention policies are needed. Across sectors, the "compliance with any law" exception is the primary tool for reconciliation, often subordinating DPDP erasure rights to other legal obligations. The Act codifies a right but simultaneously provides a powerful mechanism (Sec 12(3)) to maintain the status quo where other laws dictate retention. The Act's uniform treatment without nuances for sensitive data necessitates careful interpretation and sector-specific guidance.
8. Operationalizing Erasure: Implementation Mechanisms and Procedural Gaps
Effective realization of the Right to Erasure depends on robust implementation, clear rules, and regulatory capacity. Significant gaps exist, expected to be addressed by final DPDP Rules and the Data Protection Board (DPB).
8.1 Role of the Data Protection Board (DPB)
The DPDP Act mandates DPB establishment. As of early 2025, it's not yet constituted. The DPB is the primary adjudicatory body (digital office) with powers to inquire into violations, direct remedies, impose penalties, and act like a civil court.22 In the erasure context, the DPB will handle complaints when Fiduciaries fail erasure duties (Sec 12/8(7)), after internal redressal. It will provide authoritative interpretations (e.g., "necessary" in Sec 12(3)) and oversee compliance. Effective DPB functioning requires specialized technical and legal expertise. Reliance on a 'digital-first' DPB raises accessibility and complex evidence-handling questions.
8.2 Need for Detailed Procedural Rules
The DPDP Act leaves specifics to Rules. Draft Rules 2025 have gaps:23 Timeframes: No statutory deadline to respond to a Section 12 request (as with GDPR's one 22 Baxi, P., & Chandra, A. (2024). "The Data Protection Board of India: Institutional Design and Enforcement Challenges," Data Protection Law Review, 11(2), 132-149. 23 Bhatia, G., & Kharbanda, V. (2024). "Operationalizing Rights Under the DPDP Act: A Critical Analysis of the Draft Rules," International Data Privacy Law, 14(1), 45-61.
month). Rule 8 also covers erasure in case of inactivity (Sec 8(7)) for some organizations, but not for user requests. “Reasonable time” is not defined, making it difficult to enforce. Verification: Absence of specific guidelines on verification of identity of the Data Principal for requests for erasure (Sec 15(e)) without imposing any undue hardship. Draft Rule 10 applies to verification of parental consent, not identity aside from its role in that consent process. Notification: Clear requirements for notifying completion of erasure or reasons for not doing so?? (Sec 12(3)). Rule 8 Draft provides notice for inactivity erasure, but not in the case of a user request. Appeals: Detailed procedures/mechanism/time frames for appeals against DPB orders to AT (to be read asexamined in AT) should be provided in Rules.
Documentation: Norms for Fiduiciaries to document requests/adjustments for accountability.
8.3.1 Withdrawal Notwithstanding such withdrawals, sim cards may be use dty some time after
consent has been given and this is not considered to be a continued breach of ECPA. When withdrawal of consent will be as easy as granting it (triggers sec8(7) erasure). “Consent Manager (a registered entity on the line of a single point of contact, having an interoperable platform by creating such solutions)”, is one of the distinctive features of DPDPs. The Draft Rules specify requisites (like incorporation, net worth, neutrality and such). It is unknown if they are effective. The battle will be won via interoperability, neutrality, user adoption, and sensible processes in the final Rules for broadcasting signal of low-down numbers for deletion. Without direct challenges, cross-border revocation is difficult. If not well done, may add complexity.
9. Conclusion: Reconciling the Tensions
India's statutory Right to Erasure under the DPDP Act represents a significant milestone in the country's data protection journey. However, its effectiveness is constrained by several factors: its consent-centric trigger that narrows application, broad exceptions granting considerable discretion to Data Fiduciaries, technical challenges posed by immutable technologies, and tensions with freedom of expression and sectoral compliance requirements.
The right must be understood within India's unique constitutional and technological context. Deriving from the Right to Privacy recognized in Puttaswamy, it nonetheless represents a more circumscribed statutory implementation than might have evolved through judicial development alone. The legislature has chosen certainty over flexibility, though at the cost of potentially narrowing the right's scope. As India prepares for the DPDP Act's phased implementation, several critical issues require urgent attention:24
1. Detailed procedural rules establishing clear timelines, verification mechanisms, and
documentation requirements.
2. Robust interpretive guidelines on ambiguous terms like "necessary for the specified
purpose."
3. Specific sectoral guidance balancing erasure rights against legitimate retention needs.
4. Technical standards for erasure, particularly for DLT and other immutable
technologies.
5. Balanced jurisprudence reconciling privacy with freedom of expression.
Future amendments should consider an explicit freedom of expression exception and technical infeasibility provisions to align more closely with international best practices while preserving India's distinctive approach. 25 The Right to Erasure ultimately represents a delicate balance between individual autonomy and competing societal interests. Its successful implementation will require thoughtful interpretation by the DPB, nuanced judicial development, and continued legislative refinement to ensure it fulfills its purpose of empowering individuals while accommodating legitimate technological, expressive, and compliance needs. 24 Panda, A. , & Bhattacharjee, S. (2024). "Implementation Roadmap for India's Data Protection Regime: Key Priorities and Challenges," Computer Law & Security Review, 48, 105789. 25 Jain, N. , & Rao, T. (2024).
"Aligning Indian Data Protection with Global Standards: Recommendations for DPDP Act Implementation," Georgetown Journal of International Law, 55(3), 891-917