Implementing Right to Erasure
Liability Check
Ignoring a Data Principal's request for erasure isn't just bad PR – it's a direct violation of DPDP. Your outdated data retention policies could trigger penalties up to ₹250 Crore.
Why Implementing Right to Erasure is at Risk
The **Right to Erasure** mandates that you, as a **Data Fiduciary**, must delete a Data Principal's personal data upon request, provided there's no overriding legal obligation to retain it. This isn't just about customer records; it applies to all personal data – marketing leads, employee data, user profiles in your SaaS product. Think of the data you hold for every user on your e-commerce platform or every visitor to your tech park in Bengaluru. Failure to demonstrate a robust, auditable process for data deletion can lead to significant scrutiny from the **Data Protection Board** and steep fines for non-compliance.
Common Violations
- 1.Failing to respond to a Data Principal's erasure request within the stipulated timeframe.
- 2.Deleting data only from primary databases, leaving copies in backups, logs, or secondary systems (e.g., CRM like Salesforce, marketing automation like HubSpot).
- 3.Lacking a verifiable process to confirm complete data deletion across all integrated systems, leading to partial erasure.
The Immediate Fix
Conduct a comprehensive **data mapping exercise** to identify where all personal data is stored across your systems (databases, CRMs, cloud storage). Establish a clear, documented internal policy and procedure for handling erasure requests, including timelines, verification steps, and a method for communicating completion to the Data Principal.
Get DPDP Updates for Implementing Right to Erasure
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?