Section 12 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 12 gives a Data Principal the right to correction, completion, updating and erasure of personal data she consented to be processed. The Data Fiduciary must correct, complete and update on request, and must erase on request unless retention is necessary for the specified purpose or for compliance with law. For a workable request process, consider a legal consultation.
The Data Principal has the right to correction, completion, updating and erasure of her personal data for processing she previously consented to, including consent under section 7(a) (section 12(1)). On a request, the Data Fiduciary must correct inaccurate or misleading data, complete incomplete data and update it (section 12(2)). On an erasure request it must erase unless retention is necessary for the specified purpose or for compliance with any law (section 12(3)). No specific Schedule entry exists; the ceiling for other provisions is Rs 50 crore.
Section 12 at a glance
| Sub-section | Content |
|---|---|
| 12(1) | Right to correction, completion, updating and erasure, for processing she consented to (including section 7(a)), in accordance with any requirement or procedure under any law in force |
| 12(2) | On request for correction, completion or updating: (a) correct inaccurate or misleading data, (b) complete incomplete data, (c) update data |
| 12(3) | Request for erasure in the manner prescribed; fiduciary must erase unless retention is necessary for the specified purpose or for compliance with any law |
Section 12(1): the right
The right covers four actions: correction, completion, updating and erasure. It applies to personal data "for the processing of which she has previously given consent, including consent as referred to in clause (a) of section 7". As with section 11, the text is linked to consent, and to the voluntary-provision use in section 7(a). The text does not mention the other section 7 uses. See section 7(a) and (b).
It also says the right is exercised "in accordance with any requirement or procedure under any law for the time being in force". So where another law prescribes how a record is to be changed, for example a law on registers or official records, that procedure governs. A customer cannot use section 12 to overwrite a record that another law says can only be altered by a particular process.
Section 12(2): correction, completion and updating
Once a Data Principal requests correction, completion or updating, the fiduciary shall:
- (a) correct the inaccurate or misleading personal data;
- (b) complete the incomplete personal data; and
- (c) update the personal data.
The verbs are mandatory ("shall"). Three points:
- "Inaccurate or misleading": data that is technically accurate but gives a false impression can also fall in scope.
- The duty arises on a request, unlike section 8(3), which asks the fiduciary to keep data accurate, complete and consistent on its own initiative where it may be used for a decision or disclosed. See accuracy under section 8(3).
- The Act does not say how a dispute over what is "accurate" is settled. A fiduciary may reasonably ask for proof. Section 15(e) requires the Data Principal to furnish only such information as is verifiably authentic while exercising this right. See section 15.
The Act does not state a time for acting on the request. The manner and period, if any, are for the Rules; check them.
Section 12(3): erasure on request
A Data Principal "shall make a request in such manner as may be prescribed to the Data Fiduciary for erasure of her personal data". On receipt, the fiduciary "shall erase her personal data unless retention of the same is necessary for the specified purpose or for compliance with any law for the time being in force".
Two exceptions are built in:
- Retention necessary for the specified purpose. "Specified purpose" is the purpose stated in the notice (section 2(za)). If the data is still needed for that purpose, the fiduciary can keep it.
- Retention necessary for compliance with law. Any law in force; the test is necessity.
An important contrast with section 8(7): there, erasure is triggered by the fiduciary's own duty, on withdrawal of consent or when the purpose is no longer served, and the exception is only for legal retention. Section 12(3) is triggered by the Data Principal's request, and its exception also covers retention for the specified purpose. The two work side by side. See erasure and retention under section 8(7).
An erasure request is also not the same as withdrawal of consent under section 6(4). Withdrawal stops processing under section 6(6); a request under section 12(3) asks for deletion. A Data Principal may do either or both. See withdrawal of consent.
The Act does not say expressly that a fiduciary must pass the request on to its Data Processors in section 12. Section 8(7)(b) does require the fiduciary to cause processors to erase data in the cases that section covers, and section 8(1) makes the fiduciary responsible for processing on its behalf. In practice, plan for the request to reach processors.
When section 12 does not apply
- Section 17(1): Chapter III does not apply in the listed situations.
- Section 17(4): for processing by the State or an instrumentality of the State, section 12(3) does not apply, and section 12(2) does not apply where the processing is for a purpose that does not include making a decision that affects the Data Principal. See section 17(4) and (5).
- Section 17(5): the Central Government may declare that any provision does not apply to specified Data Fiduciaries for a period, before five years from commencement.
Consequence of breach
There is no specific Schedule entry for section 12. Item 7 covers breach of any other provision of the Act or the rules, up to fifty crore rupees. A Data Principal must first use the fiduciary's grievance redressal (section 13(3)) before going to the Board, and the Board acts after an inquiry, hearing and a finding that the breach is significant (section 33(1)). See penalties.
Practical examples
Example 1: wrong address. A customer's address is wrong on file. She asks for correction. The fiduciary corrects it under section 12(2)(a).
Example 2: partly complete record. A profile shows a loan as open although it has been repaid. The Data Principal asks for completion and updating under section 12(2)(b) and (c).
Example 3: erasure refused for law. A customer asks a bank to erase her identity records after closing her account. If law requires the bank to keep them for a period, section 12(3) permits retention for compliance with law. The Illustration to section 8(7) gives the same example.
Common mistakes
- Treating correction as optional or asking for unnecessary proof.
- Erasing everything when only part is required by law to be kept.
- Forgetting vendor copies.
- Ignoring "misleading" data that is accurate but incomplete.
Need help with correction and erasure requests?
A good process names who receives requests, what proof is asked for, which systems are searched and what legal retention applies. You can set this up with us under our legal consultation service.
Key takeaways
- The right covers correction, completion, updating and erasure of data processed on consent, including section 7(a) consent.
- On request, inaccurate or misleading data must be corrected, incomplete data completed and data updated.
- Erasure must follow a request unless retention is necessary for the specified purpose or for compliance with law.
- Other laws' procedures for changing records continue to apply.
- Section 17(4) relieves the State from section 12(3), and in part from section 12(2).
Read next
- Section 11 of the DPDP Act, 2023: right to access information
- Section 13 of the DPDP Act, 2023: right of grievance redressal
- Section 8 of the DPDP Act, 2023: erasure and retention of personal data
- Rights of the Data Principal under sections 11 to 14
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.