You delete your account on an app. But where does your personal data actually go?
It may still exist in:
- Customer relationship management systems.
- Marketing platforms.
- Payment and transaction systems.
- Cloud databases.
- Third-party Data Processor systems.
- Backups and processing logs.
Under Section 8(7) of the Digital Personal Data Protection (DPDP) Act, erasure obligations can extend to Data Processors handling personal data on behalf of the Data Fiduciary.
Some data may also need to be retained to comply with applicable laws.
So removing an account from the user interface doesn’t necessarily complete the legal erasure process.
The takeaway: Organisations need to map where personal data resides and establish deletion workflows across relevant systems and processors, while respecting legal retention requirements.
This article is general information, not legal advice.