What is a Certificate of Erasure under the DPDP Act?

Deleting a user's data is the easy part. The hard part comes months later, when a regulator, an enterprise security review, or a due-diligence team asks the real question: "prove it." A Certificate of Erasure is how you answer.

A receipt for a deletion

A Certificate of Erasure is a structured, signed record that a specific erasure request was handled. A useful one captures:

who the request was about (an opaque subject reference, not the PII itself),
what happened - deleted, anonymized, or deferred under a legal hold,
the legal basis for the decision (e.g. consent withdrawn, or RBI KYC, 5-year hold),
when it was issued, and
a link to the tamper-evident audit chain the decision came from.

Notice what's not in it: the personal data. The certificate is evidence, not content - that's what keeps it safe to store and share.

Why "tamper-evident" matters

A JSON file that says "we deleted it" is worth exactly nothing if you could have typed it yourself this morning. Two things fix that:

Hash chaining. Every audit event is hashed together with the previous one, so you can't alter or remove an entry without breaking the chain. The certificate references a verified chain. (See Tamper-evident audit.)
A counter-signature. When the certificate is signed by an independent key - getdpdp.net's - it becomes something you cannot fabricate after the fact. The issuer can verify it; you can't forge it.

from dpdpstack import issue_certificate

cert = issue_certificate(engine.audit, "user_42", "kyc")
#  -> a verifiable Certificate of Erasure (a signed JWT)

Anyone can check it

Because the certificate is signed, verification is public and needs no access to your systems. Paste the token into the public verifier and it's checked against the signing key - the result shows the issuer, whether it's in the registry, and whether it's been revoked.

That's the whole point: deletion becomes a claim that a third party can confirm. If you're building toward this, the Quickstart issues your first certificate in a few lines, and the compliance checklist shows where it fits in the bigger picture.