“Please Delete All My Data”: Is Your Organisation Ready For Data Principal Requests Under The DPDP Act?

Authored by Ammu Brigit

INTRODUCTION

Much of the commentary on the Digital Personal Data Protection Act, 2023 (“Act”) has focused on consent, breach notification and the penalty regime. Less attention has been paid to what is likely to be the first practical test for most organisations i.e., a request from an individual exercising her rights as a Data Principal.

Consider a short, polite email from a former customer. She asks the organisation (i) what personal data it holds about her, (ii) with whom it has been shared, and (iii) to erase that data and confirm erasure in writing. The request involves no regulator and no litigation. It nonetheless engages several distinct provisions of the DPDP Act and the DPDP Rules, and it requires coordinated action across legal, IT, customer service, marketing and third-party processors.

This article examines what such a request requires as a matter of law, where organisations are likely to encounter difficulty, and what steps they can take now.

THE STATUTORY FRAMEWORK

Each part of the customer’s email is covered by a specific provision under DPDP.  Together, these rules require two things: giving her the right answers and having a proper process to receive and respond to her request.

As per DPDP Act, a Data Principal must exhaust the organisation’s grievance mechanism before approaching the Data Protection Board. The internal response is therefore the first and most consequential stage. An unanswered or inadequate response is the most direct route to a complaint before the Board.

WHERE ORGANISATIONS ARE LIKELY TO STRUGGLE

The legal requirements are relatively clear. The difficulty is operational. Each obligation assumes a level of visibility over personal data that many organisations do not yet have.

A summary of the personal data held is only as reliable as the organisation’s knowledge of where personal data resides. In practice, a single customer’s data may sit in a CRM, an order management system, call recordings, support tickets, spreadsheets exported by business teams, and backups. A response drawn only from the primary system of record risks being incomplete.

The Act requires the organisation to identify recipients of the personal data collected from the Data Principals. Few organisations maintain a register that links a given customer to each processor (for example, logistics partners, payment gateways, outsourced call centres and analytics providers) that has received that customer’s data.

The Act further obliges the Data Fiduciary to cause its Data Processors to erase personal data. This depends on contractual rights to require and verify erasure. Many existing vendor agreements predate the DPDP Act and are silent on the point.

Rights requests often arrive through general customer service channels. Without a designated owner and an escalation path, the request moves between functions, and the response period runs while no one acts.

THE ERASURE-RETENTION TENSION

The erasure element of the request raises the most nuanced question. The Act establishes erasure as the default once consent is withdrawn or the specified purpose is no longer served and the retention is permitted where it is necessary for compliance with a law for the time being in force.

Two sources of retention obligation must therefore be weighed against an erasure request:

• Sectoral Laws. Invoices, transaction records and KYC records may need to be retained for prescribed periods under tax, company, banking and securities regulation. These records cannot simply be deleted on request.
• The rule also requires Data Fiduciaries to retain personal data, associated traffic data and processing logs for a minimum of one year for specified purposes.

The practical consequence is that a compliant response to an erasure request will rarely be a simple confirmation that “all data has been deleted”. More often, it will need to distinguish between data that has been erased, data that is being retained, and the legal basis for that retention. Organisations that have not mapped their retention obligations by data category will find it difficult to give such a response accurately, or to defend it before the Board.

A good privacy policy will not answer the customer’s email; what will, is knowing three things: where her data is stored, who it has been shared with, and what the law requires you to keep. The organisations that build that visibility now will be able to respond within the prescribed period with confidence. Those that do not are likely to find their gaps exposed first to their own customers, and then to the regulator.