Section 12 — DPDP Act, 2023
(1) A Data Principal shall have the right to— (a) correction of inaccurate or misleading personal data; (b) completion of incomplete personal data; (c) updating of personal data; and (d) erasure of personal data which is no longer necessary for the purpose for which it was collected. (2) Upon receipt of a request for correction or erasure under sub-section (1), the Data Fiduciary shall, where the request appears justified, correct or erase the personal data, either entirely or to the extent necessary, within such period as may be prescribed, unless retention of such personal data is necessary— (a) for compliance with any obligation under any law for the time being in force; or (b) for any other prescribed purpose.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 12 is operationally demanding. Once a correction or erasure request is received and appears justified, action is mandatory — there is no 'we'll review and consider' option. The only grounds for refusing are: a legal obligation that requires retention, or a prescribed purpose. These are narrow exceptions. Critically, the erasure right under Section 12(1)(d) applies to data that is 'no longer necessary for the purpose' — even if the Data Principal has not withdrawn consent. This creates an ongoing storage limitation obligation separate from Section 6's withdrawal right.
A Data Principal requests erasure of their account data after closing their account. The request 'appears justified' — there is no obvious reason to retain the data. The Data Fiduciary must erase unless it can point to a specific legal retention requirement (e.g., GST records must be retained for 6 years). 'We might need it later' is not a valid retention ground.
When a Data Fiduciary complies with an erasure request, it must also instruct all Data Processors who hold that data to erase it. This makes the processor contract requirement under Section 8(4) operationally critical — the contract must include a Data Fiduciary instruction-to-erase clause that the processor is bound to follow.
A user's delivery address was entered incorrectly. They request correction (Section 12(1)(a)). A user whose account they no longer use requests deletion of all their data. Erasure applies (Section 12(1)(d)). If the platform holds order records it is legally required to retain (GST Act), it can retain those while erasing everything else.