Rights

    If a customer asks us to delete their data, can we retain it for internal analytics or business use?

    Short Answer

    No, data must be deleted upon request unless there is a valid legal or operational reason for retention.

    Answer

    You can only retain data if there is a valid legal or operational requirement. Otherwise, it must be deleted once the purpose is fulfilled or upon request.

    Keeping data for "future use" without justification is not allowed under DPDP.

    Law Reference

    Section 12 – Right to Correction and Erasure

    Business Impact

    Businesses must implement automated deletion workflows and clearly document retention justifications to avoid non-compliance.

    Real-World Example

    A customer asks a telecom company to delete their data. The company can retain billing records required by tax law but must delete marketing profiles and browsing history.

    Was this answer helpful?

    Still have questions?

    Our team is here to help you with any questions about DPDP compliance.