Data privacy (DPDP Act, 2023) · Template

Data erasure confirmation letter template

Erasure is rarely total, and a confirmation that pretends otherwise is worse than none. Some data must be retained under other law — tax records, statutory registers. The letter that works says precisely what was erased, what was kept, and under what authority it was kept.

Generate this document See all 21 templates

When you need this

  • When a data principal asks for their personal data to be erased
  • On withdrawal of consent, where continued processing has no other basis
  • When an account is closed and the individual asks for deletion
  • After erasure has been propagated to processors and backups
  • Where partial retention is lawful and needs to be explained rather than hidden

What this document must contain

  • Confirmation of what was erased — Categories and systems. Vague confirmation is not verifiable and does not close the request.
  • What was retained, and the legal basis — Tax, statutory registers, an ongoing legal claim. Name the reason. Silent retention is what turns a closed request into a grievance.
  • The date erasure was completed — Fixes the point from which the data should no longer appear anywhere.
  • Propagation to processors — Confirm the instruction went to vendors holding copies. The obligation does not stop at your primary database.
  • Backups and their retention cycle — Backups usually cannot be selectively purged. Say how they are handled and when the residual copy expires.
  • Consequences of erasure — If the account can no longer function or history is unrecoverable, say so plainly.
  • The grievance route — Where the individual disagrees with what was retained, they are entitled to escalate.

The law that governs it

  • DPDP Act, 2023 — s. 12 — A data principal has the right to correction, completion, updating and erasure of personal data, in the manner the Act and the rules provide.
  • DPDP Act, 2023 — s. 13 — The right to grievance redressal, exercisable where the response to a request is unsatisfactory, sits alongside the erasure right.
  • Retention under other law — Erasure does not override an independent statutory retention duty — tax and company law records being the common examples. The letter should name the basis for anything retained.

Common mistakes

  • Confirming full erasure while records persist in a CRM, a backup or a vendor system
  • Retaining data without saying so, which converts a completed request into a grievance
  • Ignoring processors, so vendor copies survive the deletion
  • Not explaining the backup cycle, leaving the reader with an inaccurate picture
  • No date, so there is no point from which compliance can be measured

Frequently asked questions

Must I erase all data when a customer asks?

Not where other law independently requires retention — tax records and statutory registers are the usual examples, as is data needed for an ongoing legal claim. What the Act does not permit is silent retention: what is kept, and the basis for keeping it, should be stated in the confirmation.

What about data held in backups?

Backups typically cannot be selectively edited. The workable position is to confirm that the data has been erased from live systems, that it will not be restored into them, and that the backup copy expires with the normal retention cycle — stating that cycle so the reader knows when it ends.

Do I have to tell my vendors to erase it too?

Yes, where processors hold copies on your behalf. Section 8(5) of the DPDP Act, 2023 requires processing under a valid contract, and a well-drafted DPA obliges the processor to action erasure instructions and confirm completion.

What if the individual disagrees with what I retained?

Section 13 provides a right of grievance redressal. The confirmation letter should set out the route, which both discharges the obligation and usually resolves the disagreement without escalation to the Board.

Related documents