Right to Erasure under DPDP: How to Handle User Deletion Requests

Under the Digital Personal Data Protection (DPDP) Act, 2023, Indian citizens have been granted the absolute right to demand the deletion of their personal data. This is known as the Right to Erasure.

For startups, handling these requests poorly is one of the fastest ways to attract regulatory scrutiny. Here is how to manage it correctly.

What is the Right to Erasure?

When a user (Data Principal) withdraws their consent, or when the purpose for which the data was collected is fulfilled, you (the Data Fiduciary) must erase their personal data from your systems. Furthermore, you must ensure that all third-party sub-processors (like your email marketing tools or cloud providers) also delete that data.

Common Mistakes Startups Make

1. "Just email support@company.com" Relying on a shared inbox for deletion requests is a recipe for disaster. Requests get lost, SLAs (Service Level Agreements) are breached, and there is no cryptographic proof that the deletion was verified.

2. Deleting without Authentication If someone requests the deletion of ceo@competitor.com, how do you know they actually own that email? You must authenticate the requestor (usually via OTP) before touching any data.

3. Ignoring Backups Data must be purged from active databases and eventually cycled out of backup archives.

The Correct Workflow

To comply with the DPDP Act, your Erasure workflow should look like this:

1. Intake & Authentication: The user submits their email on a dedicated Privacy Portal. The system immediately sends an OTP to verify ownership.
2. Logging the Request: The request is assigned a unique tracking ID and logged in an immutable database with a strict 30-day countdown timer.
3. Data Purge: Your engineering team (or automated webhooks) deletes the data across your primary DB, CRM, and analytics platforms.
4. Audit Receipt: You generate an irreversible hash of the deletion event. If the Data Protection Board ever audits you, you have cryptographic proof that the request was fulfilled on time.

Exceptions to the Rule

You do not have to delete data if retention is required for compliance with any other Indian law (e.g., financial transaction records under RBI guidelines or tax laws). In these cases, you must explain this exception clearly to the user.

Automate the Process

Building a secure, OTP-verified portal and SLA tracker in-house takes weeks of engineering time. Infiverix provides a drop-in Erasure widget that handles authentication, tracking, and audit logging out-of-the-box.