Requesting data erasure is different from claiming an immediately enforceable statutory right under the DPDP. As of 26 October 2026, the commencement of the main rights and most business obligations is phased.
Understand the law and the process
The November 2025 notification did not bring all provisions into force at the same time. Some institutional provisions took effect immediately, some are scheduled to take effect after one year, and the main data-processing and individual-rights provisions are scheduled to take effect after eighteen months. Therefore, relying on a news report stating that the ‘law is fully in force’ to claim that you can already obtain a Board penalty or data deletion in every case may be incorrect. The company’s current privacy policy, contractual promises, information technology laws and rules applicable to the relevant sector must also be considered. A request to erase data is not always granted: there may be an independent legal basis for retaining records needed for banking, tax, litigation or fraud prevention. The end of a purpose does not mean that all backups and legally required records must be deleted immediately.
In detail: What could affect the outcome?
In your request, specify separately whether you want to close your account, stop marketing or erase records. Ask the company what data it will retain, and for what purpose and period. This makes the response easier to assess than a vague message asking to ‘delete all data’. Do not prepare a complaint by presenting a future right as one that is currently in force.
What should you do?
- Keep a copy of the privacy policy, the consent screen and your account details, and identify the grievance contact.
- Set out the action you want and ask for an acknowledgement of your request; separately ask about any retention required by law.
- After receiving a response, check the applicable commencement date and sectoral rules before choosing the next forum for a complaint.
Which documents should you keep?
Keep a copy of the policy, your consent history, your request to close the account and the company’s response.
Hypothetical example
Suppose you deleted a shopping app but continued to receive promotional emails. Uninstalling the app is not the same as deleting your account. Separate requests to withdraw marketing consent and close the account will make your actual concern clear.
Does a DPDP penalty go directly to the customer?
Do not treat a penalty and personal compensation as the same thing. A separate legal basis and an appropriate forum must be considered for compensation for loss.
Sources and related rules
Editorial review: 26 October 2026. This is general legal information. The outcome may vary depending on the facts of the case, applicable state law and subsequent amendments.