Compliance
Refusing a valid correction or erasure request breaches the Act and can lead to penalties, while retaining data without a legal basis adds compliance risk and potential fines.
Check your DPDP readiness — free More on the blogThe Digital Personal Data Protection Act gives any individual, called a Data Principal, the statutory right to ask a business, known as a Data Fiduciary, to correct, complete, update or erase personal information that the business holds. The right applies to data that was processed with the person's consent. When a request arrives, the fiduciary must act on the specific data item, not just the system where it is easiest to change, and must either comply or justify a lawful exception.
On receiving a correction request, the fiduciary must identify any inaccurate or misleading entry and amend it to reflect the true information. If the data set is incomplete, the fiduciary must add the missing elements that the principal supplies. The duty is triggered by the request itself; it is not a matter of internal policy or a separate complaint process. Failure to correct or complete the data, even after a dispute about accuracy, constitutes a breach of the Act.
A Data Principal can also ask for erasure of their personal data. The fiduciary must delete the data unless it can demonstrate that retention is essential for the purpose for which the data was collected or that a specific law requires the data to be kept. A generic business interest in keeping records, or the hope that the data may be useful later, does not satisfy the exception. Non‑compliance invites enforcement action and monetary penalties.
Many small enterprises think that a simple internal audit can replace the statutory response. The Act obliges the fiduciary to respond to each request within the time frame prescribed, explain the action taken, and retain evidence of compliance. Ignoring these steps or providing a generic acknowledgement does not satisfy the legal requirement and can expose the business to regulatory scrutiny. Retention justifications must be documented. If a business keeps data because it anticipates future marketing or analytics, that rationale does not meet the statutory test. Instead, the company must point to a specific purpose outlined at the time of collection or cite a particular law that compels storage. Without such a justification, the data must be erased, and any continued holding is treated as an unlawful breach. The right to erasure under this section is distinct from the broader duty to delete data when consent is withdrawn or the purpose lapses, which arises automatically under another provision. Here, the action is initiated by the Data Principal. Therefore, businesses should have a clear, accessible process for receiving and logging requests, so that they can act promptly and demonstrate compliance if audited. Cost considerations go beyond fines. Time spent chasing down data across multiple systems, re‑entering corrected information, and managing documentation can strain limited resources. Investing in a centralised data‑management platform reduces the risk of fragmented updates and makes it easier to produce the evidence required by regulators, ultimately lowering the financial impact of non‑compliance. In practice, a well‑structured policy that maps each data source, assigns responsibility for updates, and outlines the legal bases for retention can prevent most of the common errors. Regular training for staff handling personal data ensures that requests are treated as statutory rights, not optional customer service tickets, and that the business stays within the legal framework.
No. The Act allows refusal only when retention is necessary for the specific purpose for which the data was collected or when a law requires it to be kept. Anticipating future usefulness is not a valid legal ground, and refusing such a request would breach the provision.
The company must identify the inaccurate or incomplete data, correct or complete it across all systems where it exists, and inform the requester of the action taken. The duty is triggered by the request itself, and the company cannot demand proof of error before acting.
This section creates a right that the Data Principal must actively exercise by making a request. The fiduciary then must erase unless a legal exception applies. Automatic deletion under another provision occurs when consent is withdrawn or the purpose ends, regardless of a specific request.
Refusing a valid request constitutes a breach of the Act, exposing the business to regulatory action, fines, and possible compensation claims. The exact monetary penalty depends on the severity and the regulator's discretion, but the risk of enforcement is significant.
Published 28 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.