On this page
- What the Delhi, Bombay and Karnataka High Courts ruled on the Right to be Forgotten
- How High Court Right to be Forgotten rulings compare with DPDP Act erasure rights
- Why HR background-check firms, fintech lenders and platforms must take note
- Our view: a six-step erasure, de-indexing and accuracy workflow before 13 May 2027
- Common questions
- In the news
- Sources
Across 2026, a wave of constitutional rulings from the Delhi High Court, the Bombay High Court and the Karnataka High Court has cemented the Right to be Forgotten as an enforceable facet of informational privacy and human dignity under Article 21 of the Constitution of India. From the Delhi High Court's comprehensive 144-page judgment in Laksh Vir Singh Yadav v. Union of India directing search engines and legal portals to de-index or mask acquitted litigants, to the Bombay High Court's Nagpur Bench order masking a petitioner's identity after a quashed First Information Report, and the Karnataka High Court's rejection of the "floodgates" objection when ordering online redaction for an acquitted citizen, Indian courts are actively policing digital permanence. As the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 bring statutory erasure rights into force on 13 May 2027, businesses, publishers, platforms and background-verification vendors must understand how High Court de-indexing orders and DPDP erasure duties work together.
What the Delhi, Bombay and Karnataka High Courts ruled on the Right to be Forgotten
In each of these High Court cases, individuals who had been honourably acquitted by a criminal court, discharged before trial, or had proceedings quashed by mutual settlement found that a simple online search of their name still surfaced years-old criminal allegations on legal databases, news portals or search engines—costing them employment, visas, banking relationships and social standing. Addressing this conflict between open court records and informational privacy, the High Courts established three core principles:
- Delhi High Court (Laksh Vir Singh Yadav & connected petitions): In a 144-page ruling deciding over thirty petitions, the Court held that the right to be forgotten is an integral part of informational privacy under Article 21. Applying a structured proportionality test balancing public interest against individual harm, it directed search engines and online legal repositories to de-index or mask personal identifiers where criminal proceedings had ended in acquittal, discharge or quashing.
- Bombay High Court (Nagpur Bench, 2026:BHC-NAG:8407-DB): Ordering the High Court Registry to mask the name and personal details of an environmental consultant whose 2017 case had been amicably quashed, the Division Bench held that once proceedings are quashed, no public interest is served by keeping unredacted personal identifiers permanently searchable online.
- Karnataka High Court: Directing authorities and online platforms to mask an acquitted woman's name from digital records, the Court squarely rejected the state's plea that granting relief would "open the floodgates", holding that constitutional privacy rights cannot be denied for administrative convenience.
How High Court Right to be Forgotten rulings compare with DPDP Act erasure rights
While High Courts grant relief under Article 226 writ jurisdiction—especially for judicial records or publicly reported proceedings—the DPDP Act and Rules establish a horizontal, non-judicial erasure mechanism that every Data Fiduciary in India must operate from 13 May 2027:
| Privacy & erasure dimension | Constitutional Right to be Forgotten (High Court rulings) | Statutory Right to Erasure under the DPDP Act and Rules (from 13 May 2027) |
|---|---|---|
| Legal foundation and forum | Enforced by High Courts and the Supreme Court under Article 21 and Article 226 writ jurisdiction using the Puttaswamy proportionality test | Exercised directly by the Data Principal with the Data Fiduciary, backed by a 90-day grievance desk and complaints to the Data Protection Board of India |
| When erasure or masking is triggered | When continued online indexing or unredacted publication of past acquitted, quashed or resolved proceedings causes disproportionate harm with no live public interest | When the Data Principal withdraws consent or as soon as it is reasonable to assume that the specified purpose is no longer being served |
| Scope of publicly available records | Can order court registries, legal databases, publishers and search engines to mask names or de-index specific URLs despite initial public availability | Excludes personal data made publicly available by the individual or under a statutory obligation in India, unless a court orders redaction or de-indexing |
| Statutory retention overrides | Balances open justice and statutory court archiving against public searchability by masking public-facing copies while keeping sealed registry records intact | Pauses erasure where retention of the personal data is necessary for compliance with any law in force in India, such as tax, banking or regulatory circulars |
| Downstream vendor and processor erasure | Directs specific named respondents—such as registries, portals and search engines—to remove or de-index links | Requires the Data Fiduciary both to erase the personal data itself and to cause its Data Processors to erase the data across all subcontracted systems |
| Inactivity erasure and 48-hour advance notice | Case-specific judicial relief triggered by a litigant's petition | For Third Schedule e-commerce, gaming and social media fiduciaries at the prescribed user thresholds, mandates automatic erasure after three years of inactivity following a 48-hour advance notice |
Why HR background-check firms, fintech lenders and platforms must take note
The convergence of High Court Right to be Forgotten orders and DPDP erasure duties has immediate operational consequences beyond newsrooms and legal databases. Background-verification agencies, human-resources recruitment teams, tenant-screening portals and digital lending underwriting engines routinely scrape or cache court orders and online dispute records. If an individual has been acquitted or a High Court has ordered their name masked, continuing to store or score an unredacted scraped copy violates both the judicial masking directive and the DPDP duty to ensure completeness, accuracy and consistency when personal data is used to make a decision that affects the Data Principal.
Our view: a six-step erasure, de-indexing and accuracy workflow before 13 May 2027
In our view, digital platforms, publishers, HR recruitment desks, background-verification processors and consumer apps should unify their handling of court masking orders and DPDP erasure requests in six steps:
- Publish a clear, accessible Data Principal rights and grievance channel on your website and app, listing the specific identifier—such as registered email, phone number or account ID—needed to verify an erasure or correction request without collecting excess documents.
- Build a two-tier deletion pipeline that immediately purges erasable personal data and cascades deletion commands to every Data Processor, while isolating records subject to a statutory retention hold.
- Add a fast-track judicial compliance queue inside your grievance desk so any High Court or Supreme Court masking, redaction or de-indexing order is executed across primary pages, search sitemaps and cache layers without delay.
- Where you use personal data to make a decision affecting an applicant or customer—such as hiring, background screening or credit underwriting—allow the individual to correct and update inaccurate or outdated records cleanly.
- If your platform falls within the Third Schedule inactivity rules, configure automated 48-hour pre-erasure notices before purging inactive accounts at the three-year mark.
- Retain audit logs of all erasure requests, processor deletion confirmations and statutory retention holds for at least one year, and answer every grievance within the 90-day statutory limit.
Common questions
What did the Delhi, Bombay and Karnataka High Courts hold on the Right to be Forgotten in 2026?
Across landmark rulings including the Delhi High Court’s 144-page batch judgment and the Bombay High Court’s Nagpur Bench order (2026:BHC-NAG:8407-DB), the High Courts held that the right to be forgotten is an intrinsic facet of the fundamental right to privacy and dignity under Article 21, directing registries, legal portals and search engines to mask or de-index names of individuals whose criminal cases ended in acquittal, discharge or quashing.
How does the statutory right to erasure under the DPDP Act work from 13 May 2027?
Under the DPDP Act, a Data Principal has the right to demand erasure of their personal data, and a Data Fiduciary must erase the personal data—and cause its Data Processors to erase it—upon withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with any law in force in India.
What must background-verification firms and HR portals do when a court masks an acquitted candidate’s record?
When personal data is likely to be used to make a decision that affects the Data Principal—such as employment screening or credit underwriting—the Data Fiduciary must ensure its completeness, accuracy and consistency, honour correction and updating requests, and purge or mask records in line with judicial orders and consent withdrawal.
How long does a Data Fiduciary have to respond to a Data Principal’s erasure or correction grievance?
Every Data Fiduciary must publish the business contact details of its Data Protection Officer or designated privacy contact, specify the identifier required for a rights request, and respond to any grievance within a reasonable period not exceeding 90 days.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 07: Answer people on time, in the toolkit
- How-to 06: Keep only as long as needed, in the toolkit
- How-to 03: Know your data, in the toolkit
- The free duties list, every duty in plain words
In the news
Delhi High Court 144-Page Ruling on Right to be Forgotten: Balancing Open Justice, Search De-Indexing and Digital Erasure
Examines the Delhi High Court's landmark 144-page batch ruling (Laksh Vir Singh Yadav & connected petitions) establishing a multi-factor proportionality test for masking litigant names on court portals and directing search engines and legal databases to de-index acquitted or settled proceedings.
DPDP Act & Rules takeaway: Maps how constitutional Right to be Forgotten orders operate alongside the statutory right to erasure under Section 12(3) and Section 8(7) of the DPDP Act, 2023.
Official Regulatory Notice Exhibit (Laksh Vir Singh Yadav Batch (Del HC) · 2026:BHC-NAG:8407-DB (Bom HC) · Kar HC W.P. 2026)
View statutory briefing illustration
Source & Courtesy Reference: The Hindu (original report)Bombay High Court (2026:BHC-NAG:8407-DB) Orders Masking of Petitioner's Name on Court Portal After FIR Quashing Under Right to be Forgotten
A Division Bench of the Bombay High Court (Nagpur Bench) in ABC v. State of Maharashtra (2026:BHC-NAG:8407-DB) directed the High Court registry to mask the petitioner's name and personal identifiers from the uploaded judgment and public search metadata following the quashing of an FIR.
DPDP Act & Rules takeaway: Demonstrates that Indian High Courts actively enforce Article 21 digital dignity through targeted identifier redaction and search-engine de-indexing—workflows that legal databases, background-check vendors and publishers must execute promptly.
Official Regulatory Notice Exhibit (Neutral Citation: 2026:BHC-NAG:8407-DB (ABC v. State of Maharashtra))
View statutory briefing illustration
Source & Courtesy Reference: Verdictum (original report)Right to be Forgotten: Karnataka High Court Directs Authorities to Mask Acquitted Woman's Name from Online Records
The Karnataka High Court directed state authorities and registry portals to mask an acquitted woman's name from public digital records, holding that administrative convenience or 'floodgates' arguments cannot override a citizen's fundamental right to privacy after acquittal.
DPDP Act & Rules takeaway: Reinforces that neither public portals nor private Data Fiduciaries can cite legacy database design as an excuse for refusing lawful erasure or identifier masking.
Official Regulatory Notice Exhibit (Writ Petition Order on Right to be Forgotten (October 2026))
View statutory briefing illustration
Source & Courtesy Reference: The Hindu (original report)Supreme Court Issues Notice to Centre on 21 News Publishers' Challenge to DPDP Act and Rules; Declines Ex Parte Stay
A Supreme Court bench led by Chief Justice of India Surya Kant issued notice to the Union of India on writ petitions filed by the Digital News Publishers Association (DNPA) and 21 digital arms of legacy media houses challenging the absence of a standalone journalistic exemption in the DPDP Act, 2023 and DPDP Rules, 2025, listing the matter for 17 November 2026 without granting an interim stay.
DPDP Act & Rules takeaway: Because no interim stay was granted, the statutory compliance calendar remains unchanged—Consent Manager registration opens on 13 November 2026 and full Data Fiduciary obligations take effect on 13 May 2027.
Official Regulatory Notice Exhibit (W.P.(C) by Digital News Publishers Association (DNPA) & 21 Publishers v. Union of India)
View statutory briefing illustration
Videos
Sources
Every section, rule and date above was checked against the official text on 27 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
- Section 8(3)Duty to ensure completeness, accuracy and consistency when personal data is used to make a decision affecting the Data Principal
- Section 8(7)Duty to erase personal data and cause Data Processors to erase it on withdrawal of consent or when purpose is no longer served, unless retention is required by law
- Section 12(1)Right to correction, completion and updating of personal data
- Section 12(3)Right to erasure of personal data unless retention is necessary for the specified purpose or compliance with any law
- Section 13(1)Right to readily available means of grievance redressal
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 8(1)Third Schedule three-year inactivity erasure and 48-hour advance notice
- Rule 8(3)Minimum one-year retention of personal data, traffic data and logs
- Rule 14(3)Maximum 90-day period to respond to grievances
- Third ScheduleClasses of Data Fiduciaries and three-year inactivity periods for erasure
Notifications
- G.S.R. 843(E), clause (c)Substantive Data Fiduciary duties and Data Principal rights in force from 13 May 2027
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
