At a glanceYes. Under India’s DPDP Act you can ask any company to delete the personal data it holds on you — once the purpose it was collected for is over, or once you withdraw your consent. The company must comply, with one main exception: data it is legally required to keep for a set period. You make the request through the company’s stated contact or privacy channel.
Educational resource only. This explains the right to erasure under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and how to use it; it is not formal legal advice.
The situation
You signed up for an app, a loan comparison site, or a service you no longer use — and it’s still holding your Aadhaar copy, PAN, phone number and address. You want it gone, but you’re not sure you’re allowed to insist. You are.
When you can demand deletion
You can ask for erasure once the data has done its job, or once you take back your consent.
The DPDP Act gives you a right to erasure (Section 12). In practice it switches on in two everyday situations:
- The purpose is over. You gave a gym your ID to register; you’ve cancelled the membership. The reason they held your data no longer exists, so you can ask them to delete it.
- You withdraw consent. You can take back the permission you gave at any time (Section 6). Once you do, the company generally must stop using that data and move to erase it.
A company can’t keep your data indefinitely just because it’s convenient or “might be useful later.” Holding data with no live purpose is exactly what the Act is designed to stop.
The one big exception: data they must keep
Erasure gives way to genuine legal retention duties — not to a company’s preference.
This is the caveat that changes what you can expect, so it’s worth being precise. If another law requires a business to keep certain records for a fixed period — for example tax records, or the documents a bank or regulated lender must retain under RBI or KYC rules — it can hold that specific data for that period even after you ask for deletion. That’s a real, narrow carve-out.
What it is not is a blanket excuse. “We’d rather keep it for our records” or “it helps our marketing” are not legal retention duties. If a company points to a retention rule, it should be able to say which one and for how long — and delete the rest.
How to make the request, step by step
A clear, written request to the right channel is all it takes — you don’t need a lawyer or a form.
- Find the right contact. Look for the company’s privacy notice, “Privacy” or “Data” section, or its grievance officer / Data Protection Officer details — every organisation must publish a way to reach it.
- Put it in writing. Email or use the in-app request option. State plainly: you are exercising your right to erasure under the DPDP Act, and you want your personal data deleted.
- Identify yourself and the data. Give enough detail for them to find your records (the email or number you registered with) and name what you want deleted — everything, or specific items.
- State the trigger. Note that the purpose is over, or that you are withdrawing consent — either is a valid basis.
- Ask for confirmation. Request written confirmation once the deletion is done, and ask them to tell you if any data is being retained under a legal duty (and why).
- Keep a copy. Save the request and any reply — your proof if you need to escalate.
A useful line to include: “Please confirm the deletion in writing, and specify any data you are retaining under a legal obligation, including the specific requirement and retention period.” It quietly closes the “we’re keeping everything” loophole.
What to do if they refuse or ignore you
You have an escalation path — you’re not dependent on the company’s goodwill.
If the company ignores you or refuses without a valid legal-retention reason, first use its grievance-redressal channel, which every organisation must provide. If that still doesn’t resolve it, you can escalate to the Data Protection Board of India, the regulator that hears these complaints. Keep your written request and their response — that record is what makes an escalation straightforward.
FAQ
Can a company refuse to delete my data?
Only for data it is legally required to retain for a set period (such as certain tax or KYC records). It cannot refuse simply because it finds the data useful.
Do I have to give a reason to have my data deleted?
You state a basis — the purpose is over, or you’re withdrawing consent — but you don’t owe a detailed justification. The right is yours to exercise.
How long does a company have to delete my data?
The Act expects requests to be acted on without undue delay. If you get no response in a reasonable time, use the grievance channel, then the Data Protection Board.
Does deleting my account delete my data?
Not always automatically. Closing an account and erasing the underlying data can be separate — so make an explicit erasure request and ask for written confirmation.