Erasure under DPDP when RBI says retain

A user withdraws consent and asks you to delete their data. India's Digital Personal Data Protection Act says you must. But the same record is a KYC document that RBI requires you to keep for five years after the relationship ends - and PMLA and CERT-In have their own retention clocks.

You cannot satisfy both by simply deleting. You also cannot ignore the erasure request. The defensible answer is to resolve each field to one of three outcomes, and to record why.

Delete, defer, or anonymize

• Delete what no law compels you to keep - marketing preferences, derived analytics, anything outside a retention mandate.
• Defer what is under a legal hold. Don't delete it; mark it retained, record the statutory basis (e.g. RBI KYC, 5-year hold), and delete it when the clock expires.
• Anonymize where the value is in the aggregate, not the identity - strip the PII so the record can stay without being personal data.

The hard part is the evidence

Months later a regulator, an enterprise security review, or due diligence asks the real question: "prove you handled it correctly." That means a tamper-evident record of what you deleted, what you deferred and on what legal basis, and a Certificate of Erasure they can verify independently - one you cannot fabricate after the fact.

That is exactly what DPDPStack produces. The open-source engine runs in your code and does the delete/defer/anonymize decision locally; the hosted vault holds the counter-signed proof.

from dpdpstack import ErasureEngine, rbi_kyc, issue_certificate

engine = ErasureEngine()
res = engine.request_erasure(
    subject="user_42",
    policy=rbi_kyc("kyc"),
    reason="consent_withdrawn",
)
print(res.status)   # -> "deferred"  (not deleted; basis recorded)

cert = issue_certificate(engine.audit, "user_42", "kyc")

See the Quickstart to run your first legal-hold-aware erasure, or verify a Certificate of Erasure to see the proof side.