Someone asks us to delete their data. Must we?

Short answer: Yes, unless a law requires you to keep it

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

What the law says

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first.

Sections 11–14 · Rule 14: People can ask for a summary of their data and who it was shared with, ask for correction, completion, updating or erasure, complain, and nominate someone to act for them. You must publish how to do this.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.

Steps

Log the request and verify identity.
Check the retention schedule for each record type involved.
Delete what has no legal reason to stay, including copies with vendors and in test systems.
Mark what must stay, with the law and the end date.
Reply in plain words: what was deleted, what is kept, why and until when.

Evidence to keep

Erasure log
Vendor deletion confirmations
Reply to the person

Common mistakes

Refusing every erasure request 'because of backups'
Deleting records a law requires
Not telling vendors

How it plays out by sector

Banking, financial services and insurance: Closed-account KYC and transaction records stay for the PMLA period; offers and profiling stop at once.
Central government: ministries and departments: Section 17(4) lifts DPDP erasure for the State; public records schedules apply.
Public sector undertakings and utilities: If State provisions do not apply to the activity, normal erasure applies after legal retention.
Healthcare and hospitals: Medical records have legal minimums; a patient's erasure request cannot cut those short.
State government and local bodies: Section 17(4) lifts DPDP erasure for the State; state records rules apply.

From each seat

Legal & compliance: Approve the list of laws that require retention, so front-line teams can explain refusals correctly.
Operations head: Front-line teams need a simple answer for 'delete my data': log it, pass it on, and explain the timeline.
Customer service department: Explain clearly what can be deleted and what the law requires to be kept.

What a good answer from management sounds like

“We erase on time, keep only what the law requires, and explain the difference in every reply.” Effort and time: Medium · depends on how many systems hold copies.