s.12 · s.8 · Rule 8
Right to erasure
Section 12 gives a Data Principal the right to have personal data erased, and Section 8(7) separately requires a Data Fiduciary to erase it once consent is withdrawn or the specified purpose is no longer served.
Two routes lead to erasure. The Data Principal can ask, under Section 12(3), and the Fiduciary must erase unless retention is necessary for the specified purpose or for compliance with a law. And without any request, Section 8(7) requires erasure, by the Fiduciary and its Processors, once the purpose has lapsed or consent is withdrawn.
The exception is narrow: retention required by another law, such as tax records. Retaining data because it might be useful is not an exception.
Rule 8 adds a warning at least forty-eight hours before erasure for non-use, so the Data Principal can act if they want the data kept.
Questions people ask
- Can we refuse an erasure request?
- Only where retention is necessary for the specified purpose or required by law, under Section 12(3).
- Do we have to erase data our vendors hold?
- Yes. Section 8(7) requires the Fiduciary to cause its Data Processors to erase as well.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.