Compliance
Failure to act on a valid correction or erasure request breaches the DPDP Act, exposing the business to penalties and the need to justify any retained data under law.
Check your DPDP readiness — free More on the blogWhen a data principal contacts the firm, the request must be recorded in a central register within one business day. The log should capture the requester’s identity, the type of request (correction, completion, update or erasure), the date received and a unique reference number. This entry becomes the primary evidence that the firm acknowledged the request and started the statutory process.
The compliance officer or data protection officer (DPO) should be notified immediately. Their role is to allocate the request to the relevant operational team – for example, marketing for contact details, finance for transaction records, or IT for system‑wide data. Clear internal SOPs must state who owns each data domain, ensuring no department can claim the request is outside its remit.
The assigned team extracts a list of all records that contain the principal’s personal data across all repositories. This includes primary databases, backups, analytics stores and third‑party processors. The extraction must be documented with timestamps and system identifiers, because the duty to correct or erase applies to every copy, not just the most convenient one.
Before any erasure, the team checks whether the data is required for the purpose originally disclosed or for compliance with any other law. If a statutory retention period applies, that justification is recorded in the register. A generic business need, such as “future analysis”, does not satisfy the exception and must be rejected.
For correction, completion or updating requests, the team amends the identified records to reflect the accurate information. Changes are logged with before‑and‑after snapshots, the user who performed the edit, and the date of amendment. This audit trail demonstrates compliance if the regulator later inspects the process.
If the request is for erasure and no legal ground exists to retain the data, the team deletes the records from all active systems and flags them for removal from backups after the retention window expires. A deletion confirmation, including the reference number and date, is added to the central register.
Within the statutory period, the DPO sends a written response to the data principal confirming what action was taken or, if erasure was refused, the specific legal basis for retention. The response must reference the request ID and attach any supporting documentation required by the Act.
All logs, audit trails, legal justifications and correspondence are stored securely for the period prescribed by the Act. They must be readily retrievable for regulator audits or for the data principal’s own review. Failure to produce this evidence constitutes a breach.
You must retain the original request log, the list of records examined, before‑and‑after change snapshots, the person who made the amendment, timestamps and the final response sent to the data principal. This evidence should be stored securely for the period mandated by the DPDP Act and be available for regulator inspection.
No. The Act allows refusal only if the data is needed to achieve the purpose originally disclosed or if a specific law requires its retention. General business convenience or future analytical value does not meet the exception, and refusing on that basis would breach the law.
The data protection officer or compliance officer holds overall responsibility, but the operational team that owns each data silo must execute the deletion. The DPO must verify that every copy, including backups and third‑party stores, has been removed or scheduled for removal, and must record this verification.
The statute obliges the fiduciary to correct inaccurate or misleading data on request, regardless of internal disagreement. You must still investigate, document the findings and either correct the data or, if you believe it is accurate, follow the grievance route provided in section 13 while still responding within the statutory timeframe.
Published 13 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.