How to Handle Deletion Requests
- Name an owner, ticket template, and evidence habit before you debate edge-case wording.
- Start from the smallest repeatable path; avoid boiling the ocean.
- Log decisions so rights and complaints do not reopen old debates.
- Pair this with data mapping and retention reality—not policy alone.
- Escalate interpretation questions; do not invent legal certainty here.
See also: Compliance portal · Official resources · Guides index
Deletion rights become messy when teams do not know where data actually lives.
What the Act and Rules actually require
Erasure can come from two directions. Section 12(3) covers a direct request: the Data Principal asks, and you erase her data unless retention is still necessary for the specified purpose or required by another law. Section 8(7)–(8) covers the automatic trigger: once consent is withdrawn, or the specified purpose is no longer served (meaning the Principal has not approached you or exercised her rights for the prescribed period), you must erase — again unless law requires retention. Rule 8(2) requires giving the Principal 48 hours’ notice before that automatic erasure actually runs, so she can re-engage if she wants to keep the account.
Two retention rules often get confused. The Third Schedule’s 3-year retention window only applies to e-commerce entities with 2+ crore registered users in India, online gaming intermediaries with 50+ lakh users, and social media intermediaries with 2+ crore users — it is not a general 3-year rule for every business. Separately, Rule 8(3) sets a general 1-year minimum retention for logs and traffic data tied to security-safeguard obligations under Rule 6.
What a practical workflow needs
- One owner for intake
- Clear identity verification step
- System mapping for where data lives
- A response process and internal checklist
Common failure points
- Support teams guessing instead of following SOPs
- Analytics/CRM systems being forgotten
- Manual work with no tracking trail