India DPDPA: Article 12 – Right to correction and erasure of personal data
12. Right to correction and erasure of personal data
(1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.
(2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal,—
(a) correct the inaccurate or misleading personal data;
(b) complete the incomplete personal data; and
(c) update the personal data.
(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.
What Article 12 Means for Your Business
Article 12 gives Data Principals the right to have inaccurate or incomplete personal data corrected and to request erasure of data that is no longer needed or for which consent has been withdrawn. These rights impose operational obligations on businesses to maintain accurate data and to have processes capable of actioning correction and erasure requests.
- Upon receiving a correction request, you must correct inaccurate or misleading data, complete incomplete data, and update outdated data.
- Erasure requests must be honoured unless retention is legally required or necessary for the specified purpose, you cannot simply refuse erasure requests without a valid ground.
- Where data is likely to be used to make decisions affecting the individual, or will be shared with other Data Fiduciaries, accuracy is especially critical, ensure processes exist to maintain data quality throughout its lifecycle.
- Implement a documented request handling workflow covering receipt, verification, actioning, and confirmation of correction and erasure requests.
- Ensure that erasure from your systems extends to any data you have shared with processors, they must also delete the data upon your instruction.