Gevox
Start a scan
DPDP reference

Section 12

Right to correction and erasure of personal data

Gives the Data Principal the right to have her data corrected, completed, updated or erased.

Read this before you cite anything here

These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.

What it says

(1)
The Data Principal has the right to correction, completion, updating and erasure of the personal data she previously consented to.
(2)
On request the Data Fiduciary must correct inaccurate or misleading data, complete incomplete data, and update data.
(3)
On an erasure request the Data Fiduciary must erase the personal data, unless retention is necessary for the specified purpose or for compliance with a law.

In practice

Erasure has to propagate to processors and backups, not just to the primary record. Sub-section (3) allows retention only where it is necessary for the specified purpose or required by law, which is a narrower gate than a general business-records justification.

Read next

s.11Right to access information about personal dataGives the Data Principal the right to a summary of her data and the processing, and to know who it has been shared with.s.8General obligations of Data FiduciaryThe operational core of the Act: accountability for processors, accuracy, security safeguards, breach intimation, erasure, published contact details and grievance redressal.Rule 8Retention, erasure, and the pre-erasure warningFixes when the specified purpose is deemed no longer served for listed classes, requires a warning at least 48 hours before erasure, and sets a one-year minimum log retention.Rule 14Rights of Data PrincipalsRequires the means of making a rights request to be published, and caps the grievance response at ninety days.

The DPDP brief

One email a month. What moved in the Act, and what our scans found.

Section 12 is live. One email a month on what moved in the Act, every claim cited to its section, the same way this page is.

Notice, given under Section 5 and Rule 3

What we collect: your email address, the date you subscribed, the page you subscribed from, and your IP address. Why: to send you the Gevox DPDP brief, roughly monthly. Nothing else. We do not sell or share this list. Withdrawing: every issue carries a one-click unsubscribe that needs no login and asks no questions. Your rights: you can ask for a copy of this data, have it corrected, or have it erased, and you can complain to our Grievance Officer at grievance@gevox.in or to the Data Protection Board of India.

Notice version 2026-09-07.1. We store this text as it appears here, against your consent, so both are provable later.Privacy policy