DPDP Act Right to Erasure in India (2026): What Actually Applies

India's DPDP Act right to erasure is real law — but Section 12 doesn't come into force until mid-May 2027. This 2026 guide breaks down exactly what Section 12 covers, its consent-only limits, why the Data Protection Board still can't hear complaints, and the five removal routes that actually work today (company deletion policies, IT Rules 2021 grievance, SPDI Rules, Google policy removal, and the Right to Be Forgotten). By Jagriti Shekhar, ORM Lead at FameNinja. Read the full guide: https://fameninja.com/dpdp-act-right-to-erasure-india/

Transcript

1. T H E P R I V A C Y B R I E F Data Rights · India 2026 DPDP Act: The Right to Erasure That Isn't Live Yet India's right to be deleted is real law — but it doesn't switch on until mid-2027. Here's what Section 12 actually says, and what you can genuinely do about your data today. by Jagriti Shekhar, ORM Lead · FameNinja · 29 August 2026 O R I G I N A L LY P U B L I S H E D O N FA M E N I N J A →
2. THE CORE TRUTH The right exists on paper — not yet in force S ection 12 of the Digital Personal Data Protection Act grants Data Principals the right to correction, completion, updating, and erasure of their personal data. But under the Government's staggered commencement — notified on 13 November 2025 — Sections 11–17 only come into force in mid-May 2027. Until then, the statutory erasure right is legally inert, and anyone claiming you can invoke it today is mistaken. ! Bottom line: In 2026 you cannot yet enforce Section 12. Removal requests rely on IT Rules 2021, the SPDI Rules 2011, platform policies, and — where the harm justifies it — the courts. Nov 2025 Stage 1 — Institutions Provisions establishing the Data Protection Board of India come into effect. Nov 2026 Stage 2 — Consent Managers Consent Manager registration only. Substantive rights still dormant. May 2027 Stage 3 — The Rights Sections 7–17 (including Section 12 erasure), penalties, and exemptions finally commence. The DPDP right to erasure is a genuine coming right — simultaneously unavailable in 2026. T H E P R I VA C Y B R I E F 02
3. THE FINE PRINT What Section 12 covers — and what it can't reach The right applies only to data processed on the basis of consent — a limitation often dropped from summaries. It also governs the direct link between you and the company holding your data; it does not force that company to chase down every third party that ever received it. WITHIN REACH OUT OF REACH Erasure reaches It does not reach The company's own copy of consent-based data (the Data Fiduciary) Independent entities that received data and process it on their own Its Data Processors — cloud hosts, payroll, analytics — via Section 8(7)(b) Data brokers that scraped or purchased the data Correction, completion & updating of inaccurate records i Search engines displaying results about you Data retained where a law requires keeping it The enforcement gap: even after May 2027, the Data Protection Board has no Chairperson or Members appointed as of August 2026 — so it can't yet hear complaints or issue orders. T H E P R I VA C Y B R I E F 03
4. W H AT W O R K S T O D AY Five routes that actually apply in 2026 Choosing the wrong remedy wastes months. Match the route to what you actually want changed — the company's records, a search result, or public visibility. REMEDY W H AT I T C H A N G E S S TAT U S Company deletion policy The firm's own account & data deletion — usually fastest and free Available now IT Rules 2021 grievance A named Grievance Officer must respond within set timelines Available now SPDI Rules / IT Act 43A Older sensitive-data regime — still operative until May 2027 Available now Google policy removal Delists narrow categories: IDs, phone, address, financial, medical Available now Right to Be Forgotten Court-developed delisting of search visibility (Puttaswamy, 2017) Case-by-case Section 12 erasure Statutory deletion of consent-based data From May 2027 Deletion is a process, not a moment — always ask whether it covered backups and processors, not just the live database. T H E P R I VA C Y B R I E F 04
5. WHAT CHANGES IN 2027 Prepare now, enforce later From mid-May 2027, Section 12 becomes an actionable right, Section 8(7) forces erasure on consent withdrawal, and Section 13 adds grievance timelines. The smartest move today is to use the open routes and keep clean, dated records — a documented history of ignored requests will strengthen your position the moment the statute switches on. THE ONE PRINCIPLE Match the remedy to the moment: use what's open now, document everything, and prepare for the mechanism that arrives in 2027. READ THE FULL GUIDE This flipbook summarises a detailed guide by Jagriti Shekhar on FameNinja. Read the complete 19-minute breakdown, with every provision and step, here: R E A D O N FA M E N I N J A → fameninja.com/dpdp-act-right-to-erasure-india General information on Indian law and reputation practice as of August 2026 — not legal advice. DPDP implementation is staged and positions may change; consult a qualified Indian data-protection advocate for specific matters. 05