How do I exercise my right to erasure or correction of personal data under DPDPA?

Where you consented to a company processing your personal data, you can ask it to:

• Correct personal data that is inaccurate or misleading
• Complete personal data that is incomplete
• Update personal data that has changed (new address, new phone number, etc.)
• Erase personal data entirely, once it is no longer needed for the purpose it was collected for, or once you withdraw consent

The company must action a correction across all its live systems. For erasure, it must actually delete the data unless a specific legal retention requirement applies to that data — it cannot simply refuse because deleting it is inconvenient.

1. Find the company's published grievance channel — every Data Fiduciary is required to clearly publish this on its website or app (often listed as 'Grievance Officer,' 'Data Protection Officer,' or within the privacy policy).
2. Submit your request via the channel provided — typically an online form, a dedicated email address, or occasionally a postal address for the grievance/data protection officer.
3. Identify yourself and the specific data — be precise about what needs correcting or erasing; vague requests slow down or invite refusal of the process.
4. Keep a record of your request (screenshot, email sent, or acknowledgment received) — you'll need this if you have to escalate later.
5. Wait for the company's response within the timeline set out in the DPDP Rules, 2025 — check the current notified timeline on the Ministry of Electronics and IT (MeitY) website, as exact response and resolution periods were fixed by rules issued after the Act itself and are worth confirming rather than assuming.

Yes, in specific circumstances:

• Statutory retention requirements — banks must retain KYC and transaction records under RBI rules for a fixed period; similar retention mandates exist under tax law, SEBI regulations, and other sector-specific statutes.
• Data not based on your consent — if the company processes the data under a different legal basis (e.g., a 'legitimate use' the Act separately permits, or a contractual necessity), Section 12 erasure doesn't automatically apply.
• Ongoing legal proceedings — data relevant to an active dispute involving you and the company is generally not required to be erased mid-dispute.

If a company refuses on one of these grounds, it must tell you the specific legal basis for refusing — a bare refusal with no reason given is not compliant.

You must first exhaust the company's own grievance redressal process before approaching the Data Protection Board — you can't skip straight to the Board without giving the company a chance to respond.

You can escalate once:

• The company doesn't respond within the applicable timeline, or
• The company responds, but refuses your request without a valid legal basis, or with a resolution you consider inadequate

File your complaint with the Data Protection Board of India once it is operational and accepting complaints in your case category — check the Board's current status and filing process, since it was established after the Act's core provisions and its complaint-handling procedures have been rolled out progressively. Keep your original request and any company correspondence as evidence when you escalate.