Data Access and Deletion Requests What to Check First
You signed up for an app three years ago, forgot about it, and now you want your data gone. Or maybe you received a suspicious call and want to know exactly what a company holds about you. Either way, before you fire off a data access or deletion request, there are a few things worth checking. Skipping these steps is the most common reason requests get delayed or rejected.
What Are Data Access and Deletion Requests?
A data access request lets you ask any organisation what personal information they hold about you. A deletion request sometimes called the right to erasure asks them to remove it. In India, these rights are now backed by law under the Digital Personal Data Protection Act, 2023 DPDP Act, passed by Parliament in August 2023. The rules under the Act are being finalised by the Ministry of Electronics and Information Technology (MeitY), but the rights themselves already exist in the statute.
If you are dealing with a company that operates in the EU or handles EU user data, the GDPR gives the same rights with a 30-day response window. For purely Indian companies, the DPDP Act is the applicable law and a similar response timeline is expected once the rules are notified.
Check Your Identity Documents Before Anything Else
Most companies will reject your request if they cannot confirm who you are. This is actually a security measure in your favour. Before you submit, gather the following:
- A government-issued photo ID Aadhaar card, PAN card, or passport.
- The email address or phone number linked to your account with that company.
- Any account ID or registration number if the service gave you one.
Some platforms, especially fintech apps and telecom providers, may ask for a selfie with your ID. Keep a clear scan ready. If you are making the request on behalf of someone else, such as an elderly parent, you will also need a signed authorisation letter from them.
Verify Which Law Applies to Your Situation
This step saves a lot of confusion. The law that applies depends on where the company is based and where your data is processed.
| Situation | Applicable Law | Response Window |
|---|---|---|
| Indian company, Indian user | DPDP Act 2023 | Rules being finalised (30 days expected) |
| EU-based company, any user | GDPR | 30 days |
| US-based company, Indian user | No guaranteed federal right yet | Varies by company policy |
| Indian company with EU operations | Both DPDP Act and GDPR may apply | Stricter of the two |
For most Indian users dealing with apps like food delivery platforms, ride-hailing services, or e-commerce sites registered in India, the DPDP Act applies. You can check a company’s registration on the MCA21 portal if you are unsure.
Find the Right Contact Point
Do not send your request to a general customer care email. Under the DPDP Act, every significant data-handling organisation must appoint a Data Fiduciary essentially the entity responsible for your data and provide a contact mechanism for grievances. Look for:
- A Privacy Policy page on their website, which should list a Data Protection Officer (DPO) or grievance officer email.
- A dedicated privacy request form, which larger companies like Google, Meta, or Zomato provide under Account Settings.
- If you are dealing with a financial institution, the RBI’s Integrated Ombudsman Scheme can be a parallel escalation path for data-related complaints linked to financial services.
If the company has no clear contact, send your request by registered post to their registered office address and keep the receipt. This creates a paper trail.
What to Include in Your Request
A vague request is easy to ignore or mishandle. Write a clear, short message that covers:
- Your full name and the account email or phone number.
- Whether you want access, deletion, or both.
- The specific data you are asking about, if you know it for example, all transaction records or my location history.
- A request for written confirmation once the action is completed.
You do not need a lawyer to write this. A polite, specific paragraph works better than a long legal-sounding letter. Keep a copy of everything you send.
Understand What Companies Can Legally Retain
Even after a deletion request, companies are allowed to keep some data. Under Indian law and general compliance norms, financial records may need to be retained for seven years per income tax rules. Telecom providers keep call records for a period mandated by the Department of Telecom. Courts can also order data preservation.
When you get a response, check whether the company has explained what they are retaining and why. If they cite a legal obligation, ask them to name the specific law or rule. That is your right.
Online Platforms with Special Considerations
For platforms that involve real-money activity or competitive gaming, data requests can sometimes surface sensitive transactional history. For instance, if you have used a platform like lotus365 cricket for sports-based gaming, the platform is expected to hold KYC records Aadhaar, PAN and transaction logs as required by applicable financial regulations. Requesting deletion of an active account on such platforms usually requires settling any pending balance first and completing a formal account closure process before the data request is actioned.
Similarly, if you have engaged with services under a lotus365 red category or similar variant, check the platform’s terms of service for their data retention clause before submitting a deletion request. Many gaming and entertainment platforms retain financial data for at least five years regardless of account closure.
Caution: Online real-money gaming platforms in India operate under a patchwork of state-level laws. Some forms of online gaming may be restricted or regulated differently depending on your state. Always confirm the legal status in your state before participating, and be aware that data submitted during KYC cannot typically be erased while a legal or regulatory obligation to retain it exists.
