Right to Erasure

DPDP Act 2023 — Section 12(3)

Under Section 12(3) of the DPDP Act 2023, a Data Principal has the right to withdraw consent and request erasure (deletion) of their personal data from a Data Fiduciary's systems. Upon withdrawal of consent, the Data Fiduciary must erase the personal data within a reasonable period unless retention is required by any law in force. In banking, this right intersects with RBI's KYC retention requirements — a bank cannot erase KYC data during the mandatory retention period even if the customer requests it. The right to erasure also does not apply to data processed under "deemed consent" provisions (Section 7) or for compliance with legal obligations.

The right to erasure under Section 12(3) of the DPDP Act 2023 lets a data principal withdraw consent and seek deletion of their personal data, with the Data Fiduciary obliged to erase within a reasonable period unless a law requires retention. In banking this right runs straight into a real conflict: a bank cannot delete KYC records during RBI's mandatory retention window even if the customer demands it, and the right does not reach data processed under deemed-consent grounds or held for compliance with legal obligations. The practical task for counsel is to triage each erasure request — honouring it where no overriding retention duty applies, and recording the lawful basis for refusal where one does. A borrower in dispute may use an erasure request strategically, so the institution must respond on the statute rather than reflexively refusing or blanket-deleting. Getting it wrong either way — erasing data the law requires kept, or ignoring a valid request — creates exposure. Well-advised lenders map retention obligations against erasure rights before responding.