Section 12 of Digital Personal Data Protection Act, 2023 - Right to Correction and Erasure of Personal Data
Section 12 of the Digital Personal Data Protection Act, 2023 gives a Data Principal a statutory framework to seek correction, completion, updating and erasure of personal data processed on the basis of consent, subject to the Act, prescribed procedure and other applicable law.
Section 12: Right to correction and erasure of personal data
(1) A Data Principal shall have the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7, in accordance with any requirement or procedure under any law for the time being in force.
(2) A Data Fiduciary shall, upon receiving a request for correction, completion or updating from a Data Principal:
(a) correct the inaccurate or misleading personal data;
(b) complete the incomplete personal data; and
(c) update the personal data.
(3) A Data Principal shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data, and upon receipt of such a request, the Data Fiduciary shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force.
What does the right to correction, completion and updating mean?
Once Section 12 becomes operative, a Data Principal may ask the relevant Data Fiduciary to correct personal data that is inaccurate or misleading, complete data that is incomplete, or update data that is no longer current. The right under Section 12(1) is tied to personal data processed on the basis of the Data Principal's prior consent, including consent falling within Section 7(a).
The provision places a corresponding duty on the Data Fiduciary under Section 12(2) after a valid request is received. The practical request mechanism is supplemented by the Digital Personal Data Protection Rules, 2025.
Right to request erasure of personal data
Section 12(3) provides for a request to erase personal data. Erasure is not an unconditional deletion right. The Data Fiduciary must erase the data after receiving a request unless continued retention is necessary for the specified purpose or is required for compliance with a law in force.
Limits on erasure under Section 12
The statutory exception is important. A request for erasure does not require deletion where retention remains necessary for the specified purpose or for compliance with another law. Accordingly, the legal basis and retention obligation applicable to the particular record should be checked before treating an erasure request as requiring immediate deletion.
The 2025 Rules also contain separate retention and erasure provisions. Rule 8 addresses when a specified purpose may be deemed no longer served for certain classes of Data Fiduciaries and purposes, and it includes retention requirements for specified processing records and logs. These provisions should be read together with the Act once the relevant provisions commence.
Digital Personal Data Protection Rules, 2025: procedure for exercising rights
Rule 14 provides the operational framework for Data Principal rights. Once that rule becomes operative, a Data Fiduciary and, where applicable, a Consent Manager must prominently publish the means by which a Data Principal can make a rights request and the identifying particulars that may be required. A Data Principal may then use the published mechanism and furnish the required particulars to exercise rights under the Act.
Rule 9 separately requires publication of business contact information for the Data Protection Officer, where applicable, or another person able to answer questions on behalf of the Data Fiduciary about processing. The commencement notification and the Rules should therefore be checked when determining which obligations are legally operative on a particular date.
Key definitions relevant to Section 12
Data Principal
Under Section 2 of the Act, a Data Principal is the individual to whom the personal data relates. Where the individual is a child, the expression includes the parent or lawful guardian, and where a person with disability has a lawful guardian acting on her behalf, it includes that guardian.
Data Fiduciary
A Data Fiduciary is a person who alone or together with others determines the purpose and means of processing personal data.
Personal data
Personal data means data about an individual who is identifiable by or in relation to such data.
Processing
Processing refers to a wholly or partly automated operation or set of operations performed on digital personal data, such as collection, recording, organisation, storage, use, sharing, disclosure, alteration, retrieval, erasure or destruction.
Practical significance of Section 12
Section 12 is intended to give individuals a direct mechanism to improve the accuracy and currency of consent-based personal data and, where the statutory conditions are met, to seek its erasure. For organisations, the provision makes request handling, identity matching, data location, correction workflows, retention schedules and legal-hold checks important parts of DPDP compliance planning.
This page is a general legal information resource. Applicability can depend on the facts, the commencement status of the relevant provisions and other laws requiring retention of particular records.