Delete request vs invoices under the DPDP Act: which one wins?

A customer writes: delete everything you hold about me. Part of what you hold is an invoice you may have to keep for another law. This page sets out what the DPDP Act and Rules say about that clash. The sections on the law are cited in the Sources box. The section marked Our view is our opinion and carries no citation.

What the law says about erasure

A person has the right to ask for erasure of her personal data when she gave consent for the processing. This includes details she voluntarily gave you for a purpose, where she has not told you she does not consent to that use. She makes the request in the manner the Rules prescribe. Once she does, you must erase her data unless keeping it is necessary for the specified purpose or for compliance with any law in force.

The Act also limits the duty to erase when a person withdraws consent or the purpose is no longer served: you must erase, and cause your Data Processors to erase, unless retention is necessary for compliance with any law. It also says that when a person withdraws consent you must stop processing her data unless the Act, the Rules or another law requires or authorises the processing.

The Act’s own example

A person closes her savings account. The bank is required by a law that applies to banks to keep the record of her identity for ten years after the account closes. Because retention is necessary for compliance with law, the bank keeps her personal data for that period. The Act gives this example itself, so the idea of a legal duty to keep a record overriding erasure is written into the law.

What the law does not say

The Act and Rules do not mention invoices, tax or any particular record-keeping law, and they do not give a retention period for invoices. They only say that retention is allowed when it is necessary for compliance with a law. The period, and what a record must contain, come from the other law. Those laws are not part of the official text we checked for this page. Check the law that applies to your invoices, or ask your accountant, for the period and the fields it requires.

The one-year minimum

The Rules add a separate rule. A Data Fiduciary must keep personal data, traffic data and logs of the processing for at least one year from the date of the processing, for the purposes the Seventh Schedule lists, and then erase them unless another law requires longer. The Rules’ own example is an e-book platform: it must keep order details, personal data and logs such as order confirmation, payment and delivery events for at least one year from the transaction, even if the customer deletes her account.

What stays and what goes

Requests and complaints

A customer makes the request through the means you publish for rights requests, and must use your grievance process before going to the Board. Data Principal rights and the 90-day grievance limit. For how long you can keep data when no law applies, read how long you can keep customer data.

These duties start on 13 May 2027.

Our view: a way to handle the request

Our view. This is how we would handle the request.

1. Split the customer’s record into what a law requires you to keep, which may include an invoice, and everything else, such as marketing preferences, saved addresses and chat history.
2. Erase everything else, including copies at your suppliers, once nothing in the sections above requires you to keep it. Your software vendors as Data Processors.
3. Keep the invoice for the period the other law sets. Do not use it for anything else, such as marketing.
4. Write down which law you relied on, and the date you will delete what you kept. Delete it on that date.
5. Tell the customer what you erased and what you kept, and why.