A Client Asks You to Delete Their Data: The Right to Erasure Under DPDP
A client emails at six in the evening: "Delete everything you hold about me." Nobody has checked which of those files the law still asks you to keep.
The right to erasure under DPDP lets a person ask a firm to erase their personal data. The firm must do so, unless it needs to keep the data for the specified purpose or under a law. The main duties apply from about 13 May 2027, unless the government shortens the period, so the habit starts now. Erasure requests often arrive with a client's access request first. Answer that one before you start deleting.
Which records can you refuse to erase?
Tax records are the big exception. Statutory record-keeping under GST and income-tax rules overrides an erasure request for those records. The table shows the usual files, why each one stays or goes, and who else holds a copy.
| Document | Why it is needed | Who else has it |
|---|---|---|
| Return and computation copies | Statutory record under income-tax rules | The client, and the tax portal |
| GST invoices and returns | Statutory record under GST rules | The client, and the GST portal |
| Engagement letter and fee invoice | Record of the work and the fee | The client |
| Aadhaar and PAN copies | Only while the purpose lasts, unless a law needs them | The client, and any staff phone they were sent to |
| Intake forms and family details | Only what the work needed | The client |
| Newsletter contacts | Consent is the basis, so erase when it is withdrawn | Usually none |
| Access logs | Keep for at least one year | The firm's own system |
A copy held by the client or by the department is not yours to erase. Your job is the copy you hold, wherever it sits in the office. How long to keep ordinary files is a separate question, covered in our guide on keeping client documents.
What do firms get wrong?
- Deleting a statutory record. The return and the GST invoice stay. Say so in the reply.
- Refusing with no reason. A bare "no" invites a grievance. Name the record and the law that keeps it.
- Erasing the folder, not the copies. A copy on a staff phone or in an old email thread is still personal data the firm holds.
Clear notices at the start reduce these requests. The consent notice sample shows the layout.
How do you answer the request, step by step?
Work in this order. Each step leaves a paper trail the firm can show. The picture sums up the five steps.
- Log the request. Note the date received and who is asking. Check that the request comes from the client before you act on it.
- Find every copy. Check the client folder, the email, the phone, the chat threads and any scanned copies on laptops. Paper that was never digitised sits outside the Act, but once it is scanned or entered into a system, it is covered. The guide on whether paper files are covered explains the line.
- Decide record by record. Erase what no law or purpose needs. Keep what the law requires, and write down why.
- Reply in writing. Say what was erased, what was kept, and the reason for each kept record. Rule 14(3) of the DPDP Rules, 2025 requires the firm to publish the period within which it answers grievances, and that period cannot exceed ninety days. Do not wait that long for a simple request.
- Keep the log. Certain logs and data must be kept for at least one year. Keep the access logs and the request record together.
If the client is unhappy with the answer, the firm's grievance process comes first. The client can go to the Data Protection Board only after that, under section 13.
Keep every copy in one folder
Reposha, DPDP-ready document management for professional firms, puts each Client's files in one folder, so step two has one place to check. You send one upload link per request. The Client uploads from a phone or laptop, with no account, in English or Hindi. Only staff with access to a Client can open that Client's files.
With Reposha, the access log shows who opened each file and when. Every open and download is logged, and retention options are 6 months, 1 year and 3 years.
Start at reposha.com.
Questions people ask
What is the right to erasure under the DPDP Act?
It lets a person ask a firm to correct, complete, update or erase their personal data. The firm erases it unless it must keep it for the specified purpose or under a law.
Can a CA firm refuse an erasure request?
Only for records the law requires it to keep, such as statutory tax records. Say which records are kept, and why, in the written reply.
When do the erasure rights start to apply?
The main duties, including the rights of Data Principals, apply from about 13 May 2027, unless the government shortens the period.
How can a firm handle erasure requests without losing track?
Keep one folder per client and a log of every open and download. Reposha, DPDP-ready document management for professional firms, gives each Client a folder and logs every open.
General information only, not legal, tax or financial advice. Rules and dates change, so confirm before acting.
Open the demo account to see how requests, folders and the activity record look. No sign-up needed.
