DPDPStack logodpdpstack
← Blog

Right to erasure under the DPDP Act: a developer's guide

Under India's DPDP Act, a Data Principal can ask you to erase their personal data, and as a Data Fiduciary you're generally required to do it - and to make sure your processors do too. Here's what that means in code.

When erasure is triggered

The two common triggers are:

  • the user withdraws consent, or
  • the data is no longer necessary for the purpose it was collected for.

Either way, the clock starts. You should erase the relevant personal data unless retention is required for a legal purpose.

When you can lawfully not delete

This is the part teams miss. "Erase" is not absolute. If another law requires you to retain a record - RBI's KYC retention, PMLA, CERT-In logging - you don't delete it on request; you defer, record the statutory basis, and delete it when the retention period ends. Treating every field the same way is how teams get this wrong. The full pattern is in Erasure when RBI says retain.

So every field resolves to one of three outcomes: delete, anonymize, or defer (with a basis).

The implementation trap: it's not one DELETE

A deletion that only hits your primary database isn't complete. The same user lives in your analytics, CRM, search index, data warehouse, and backups. Real erasure has to fan out to all of them and collect confirmation from each. That fan-out - plus the proof - is the bulk of the work.

from dpdpstack import ErasureEngine, rbi_kyc

engine = ErasureEngine()
res = engine.request_erasure(
    subject="user_42",
    policy=rbi_kyc("kyc"),
    reason="consent_withdrawn",
)
print(res.status)   # -> "deferred" or "deleted", with the basis recorded

Don't forget the proof

Whatever you decide for each field, record it in a tamper-evident audit log and - when it's a true erasure - issue a Certificate of Erasure so you can later prove you complied. A deletion you can't prove is, for audit purposes, a deletion that didn't happen.

Start with the Quickstart, or see the broader DPDP compliance checklist for how erasure fits alongside consent, retention and breach response.