Definition
Erasure is the Data Fiduciary's duty under Section 8(7) of the Digital Personal Data Protection Act, 2023: cease to retain personal data, or remove the means by which it can identify the Data Principal, once the specified purpose is served — unless retention is necessary for compliance with any law in force. That last clause is a named keep (for example an RBI KYC class), not a slogan that freezes every WhatsApp export. Processor copies remain personal data. A live person can also seek erasure as a right under Section 12, subject to the same legal-keep exception. Tokens that still identify the person are not a workaround.
How this matters in practice
In practice, erasure fails on surplus copies: shared drives, UAT, LSP CSVs, a reject pack kept 'in case'. Name the purpose and the keep on one sheet. When the purpose ends and no law holds the row, delete it and log the date. Architecture that stops identifiers cloning into every tool makes the Section 8(7) pull possible. Software is not the keep and not a Rule 13 auditor.
Frequently asked questions
Does Section 8(7) let us delete KYC the day a loan closes?
No. Section 8(7) is subject to any law for the time being in force. Where the RBI KYC Direction names a five-year keep for a customer relationship, that class stays until the clock ends. Extra copies — marketing lists, WhatsApp, UAT — are usually not that keep. Delete those.
Does DPDPA create a heavier erasure rule for old sensitive personal data?
No. The DPDPA does not revive the old SPDI sensitive personal data category. Aadhaar, health files and bureau extracts are personal data under Section 2(t). Erasure follows purpose plus law in force, not a special tier.
Does buying software discharge the erasure duty?
No. You still write the record-class map, name the legal keep, and delete surplus copies. Processor contracts under Section 8(2) need a deletion date. Rule 13 annual DPIA and audit remain Significant Data Fiduciary only, after Section 10 notification.
Map what you can erase this month
Book 30 minutes to separate statutory keeps from surplus copies before the 13 May 2027 duties bite.
Book a demo
Free Gap Analysis
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.