Data privacy (DPDP Act, 2023) · Template
Erasure is rarely total, and a confirmation that pretends otherwise is worse than none. Some data must be retained under other law — tax records, statutory registers. The letter that works says precisely what was erased, what was kept, and under what authority it was kept.
Quick Statutory Answer
Must I erase all data when a customer asks? Not where other law independently requires retention — tax records and statutory registers are the usual examples, as is data needed for an ongoing legal claim. What the Act does not permit is silent retention: what is kept, and the basis for keeping it, should be stated in the confirmation.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
REQUEST DETAILS
Date: [Date of This Confirmation]
To, [Customer's Full Name]
Subject: Confirmation of Erasure of Your Personal Data
Dear [Customer's Full Name],
Further to your erasure request dated [Date the Customer Requested Erasure] (identified by: [Customer Identifier Used]), and in accordance with your rights as a Data Principal under the Digital Personal Data Protection Act, 2023, we confirm the following.
CONFIRMATION OF ERASURE
1. Scope of Erasure. We have erased or anonymised the personal data associated with your account/identifier from our active systems and records, save for any data we are required to retain under applicable law.
2. Systems and Records Purged. The following systems and records have been purged of your personal data: [Systems / Records Where Data Was Deleted].
3. Third-Party / Vendor Instructions. [Status of Instructing Vendors/Processors to Delete Their Copies].
4. Statutory Retention Exceptions. The following data, if any, has been retained solely to comply with statutory or regulatory obligations and will be deleted upon expiry of the applicable retention period: [Any Data Retained for Legal Reasons].
CLOSING
Should you have any further questions regarding this confirmation, or wish to exercise any other rights available to you as a Data Principal, please do not hesitate to contact us.
Yours sincerely, [Your Business Name]
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| Confirmation of what was erased | Categories and systems. Vague confirmation is not verifiable and does not close the request. | DPDP Act, 2023 — s. 12 |
| What was retained, and the legal basis | Tax, statutory registers, an ongoing legal claim. Name the reason. Silent retention is what turns a closed request into a grievance. | DPDP Act, 2023 — s. 13 |
| The date erasure was completed | Fixes the point from which the data should no longer appear anywhere. | Retention under other law |
| Propagation to processors | Confirm the instruction went to vendors holding copies. The obligation does not stop at your primary database. | DPDP Act, 2023 — s. 12 |
| Backups and their retention cycle | Backups usually cannot be selectively purged. Say how they are handled and when the residual copy expires. | DPDP Act, 2023 — s. 13 |
| Consequences of erasure | If the account can no longer function or history is unrecoverable, say so plainly. | Retention under other law |
| The grievance route | Where the individual disagrees with what was retained, they are entitled to escalate. | DPDP Act, 2023 — s. 12 |
Not where other law independently requires retention — tax records and statutory registers are the usual examples, as is data needed for an ongoing legal claim. What the Act does not permit is silent retention: what is kept, and the basis for keeping it, should be stated in the confirmation.
Backups typically cannot be selectively edited. The workable position is to confirm that the data has been erased from live systems, that it will not be restored into them, and that the backup copy expires with the normal retention cycle — stating that cycle so the reader knows when it ends.
Yes, where processors hold copies on your behalf. Section 8(5) of the DPDP Act, 2023 requires processing under a valid contract, and a well-drafted DPA obliges the processor to action erasure instructions and confirm completion.
Section 13 provides a right of grievance redressal. The confirmation letter should set out the route, which both discharges the obligation and usually resolves the disagreement without escalation to the Board.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.