Managing 3 Types of Data Erasure Requests: News Media's Section 12 Compliance Guide

Applies to	News Media Outlets & Photojournalism Studios operating in India
Primary law	DPDPA 2023 · Section 12
Penalty ceiling	up to ₹200 crore per violation
Enforcement status	Data Protection Board accepting complaints — 2026-07
Source	DPDPAReady Compliance Team

Section 12: What News Media Must Know About Data Correction and Erasure Rights

Section 12 of the Digital Personal Data Protection Act, 2023 grants every individual—whether a source, quoted subject, or featured person in your photograph—the right to request corrections and erasure of their personal data. The statute reads:

“Data Principal has the right to correct inaccurate personal data, complete incomplete personal data, update personal data, and erase personal data that is no longer necessary for the purpose for which it was collected or processed.”

For news outlets and photojournalism studios, this creates a structural tension: you need to preserve archives for public record, legal defense against defamation claims, and historical reference journalism, but individuals can demand you correct misspellings, delete photos, or erase quotes that embarrass them. Section 12 does include an exception—you need not comply if “retention is required by law”—but that exception is narrow and requires documented justification for every single request.

The penalty for ignoring a valid Section 12 request or failing to implement a correction properly is up to ₹200 crore per violation. For a news outlet, even one unresolved erasure request from an aggrieved data subject can trigger an audit by the Data Protection Board of India, reputational damage, and cascading legal liability.

How to Build a Section 12 Compliance Process for News Outlets: Seven Essential Steps

The following steps form a defensible Section 12 workflow. Implement them in order and document each one.

Step 1: Establish a Public Data Rights Request Channel

Create a formal mechanism for data subjects to submit correction or erasure requests:

• Add a dedicated email address to your website (e.g., data-rights@youroutlet.in or privacy@youroutlet.in)
• Publish a simple web form on your privacy page or “Contact Us” section
• Include the request channel in your privacy policy, website footer, and article mastheads
• Display contact information in your office (for in-person visits from data subjects)

Why this matters: Compliance begins with visibility. If data subjects cannot find your request channel, they will lodge complaints directly with the Data Protection Board. A documented, easy-to-find channel proves you are taking Section 12 seriously.

Step 2: Log Every Request with Timestamp and Metadata

The moment a request arrives, create a permanent record in a spreadsheet or database:

• Request date, time, and channel (email, web form, postal mail)
• Data subject’s name, email, phone number
• Specific claim: which article, date, photo, or data point is inaccurate, incomplete, or outdated
• Exact change requested (correct this name, remove this photo, erase this quote)
• Status field: received → under review → approved → rejected → implemented

Why this matters: Section 12 requires you to comply with valid requests unless retention is legally justified. This log is your primary defense in an audit. Auditors will ask: “Show me your system for processing Section 12 requests.” No log = presumption of negligence. A documented log proves you took the request seriously.

Step 3: Verify the Data Subject’s Identity

Before erasing or correcting any data, confirm who you are talking to:

• Request government-issued ID (Aadhaar, PAN, passport, or driving license)
• Compare the name and date of birth in the ID to your records
• For sensitive data erasure (photos, health mentions, identifying information), require in-person verification or a notarized request
• For minor corrections (fixing a spelling of a public figure’s name), email confirmation may suffice

Security reason: Malicious third parties could falsely claim to be “Raj Kumar” and demand you erase articles about a competing business named Raj Kumar, or erase a politician’s arrest record to cover up a crime. Identity verification protects the public record and the integrity of your journalism.

Step 4: Assess Whether Retention Is Legally Required (The Critical Decision)

This step determines whether you must comply with erasure requests or can refuse. Section 12 states: “erase data no longer necessary for the purpose for which it was collected or processed.” For news media, retention is often justified because your stated purpose includes public record, legal defense, and archival journalism.

Factors that justify retention (DO NOT erase if any apply):

• The data is part of published news reporting on a matter of legitimate public interest (crime, political scandal, environmental disaster, public health threat, financial fraud)
• Legal or regulatory obligations: a court order, regulatory filing, tax statute, or Freedom of Information Act request requires retention
• The subject is a public figure or newsmaker (politician, business leader, celebrity, public official) and the reporting relates to their public role
• Your privacy policy stated at the time of collection that news archives are retained indefinitely
• Defamation or libel defense: you may need the original data to defend a future lawsuit by the subject

Factors that support erasure (DO erase if applicable):

• The subject is an accidental bystander: their face appears in a crowd photo of a protest, they are now unidentifiable or irrelevant to the story
• The data was collected for a temporary, specific purpose that has concluded: an internal source list for a one-time investigation; the source has since passed away or the story is no longer relevant
• The subject is a minor or was a minor when the data was collected: a school report card, disciplinary record, or school event photo from a retired journalist’s archive
• The data is non-public and was never published: internal notes, draft interviews, rejected sources, or editorial correspondence

Write down your reasoning in Step 5 below. Vague retention arguments (“we keep everything” or “it’s on the internet”) will not survive audit by the Data Protection Board.

Step 5: Prepare a Formal Written Response Within 30 Days

Section 12 does not specify a deadline, but industry best practice (and Section 7 of DPDPA) requires a response within 30 days. Your response should clearly state your decision and reasoning.

If you are correcting inaccurate data:

• Confirm which specific data points you have corrected
• Explain how you updated it (database entry, article metadata, correction note appended to the article)
• Publish a visible correction note or retraction if the error was significant (incorrect facts, misidentification, wrong date)
• Notify third parties who republished the article (news wire services, RSS aggregators, partner websites)

If you are erasing the data:

• Specify what you are erasing and when the erasure will be complete
• Confirm erasure across all systems: CMS, archives, syndicated copies, social media, search engine cache
• Explain any depersonalization: the article remains published but the subject’s name is removed, or the photo is pixelated

If you are refusing to erase (retention is justified):

• State the specific legal or business ground for retention (e.g., “published news of public interest,” “legal obligation,” “public figure reporting,” “defamation defense”)
• Cite Section 12: “retention is required by law or legitimate business interest”
• Offer alternative remedies: factual correction, depersonalization, or a context note added to the article
• Assure the data subject that you will reconsider if circumstances change (e.g., if the subject is no longer a public figure, or if a legal obligation expires)

Example refusal letter:

We received your request to erase all data related to the article “City Councilor Faces Investigation Over Land Deal” published March 15, 2024. We are declining full erasure on the ground that this article documents a matter of significant public interest and remains part of our permanent news archive. You are a public figure in your role as city councilor, and retention of this reporting is necessary for public record, legal defense, and future historical reference. However, we will [offer to correct specific factual errors / remove family members’ names / depersonalize minor children’s identities] as an alternative remedy. We will revisit this decision if you step down from public office.

Step 6: Execute Corrections and Erasures Across All Systems

A correction or erasure is incomplete until it is implemented everywhere data appears:

• Website CMS: Update the article text, metadata, or subject index
• Photo database: Update captions, keywords, or depersonalize identifying information
• News wire syndication: Notify Reuters, PTI, ANI, or other wire services of corrections
• RSS feeds and email newsletters: Ensure corrections propagate to subscribers
• Social media: Update or delete posts linking to the article, or add a correction comment
• Search engines: Use Google Search Console or Bing Webmaster Tools to request reindexing if you’ve depersonalized content
• Archived copies: Add a note or flag to archived versions explaining changes

Best practice: Do not silently delete published articles. Readers deserve to know why an article was edited. Append a correction note (e.g., “CORRECTION: This article has been updated to correct the subject’s name, which was previously listed as…”) or a retraction (if the article is factually incorrect).

Step 7: Maintain an Audit Trail and Review Annually

Store and organize:

• Original Section 12 request (email, form submission, or postal letter)
• Your decision and documented justification
• Date implemented
• Proof of notification to the data subject (email, postal receipt)
• Any third-party notifications (wire services, syndication partners)

Review this log once per year to identify patterns:

• Are the same reporters or sections repeatedly named in requests?
• Are you over-retaining data after its news value has expired?
• Are data subjects having difficulty finding your request channel?
• Are certain categories of data (photos, medical mentions, family names) over-represented in erasure requests?

Use these patterns to improve your process: train reporters, update archive retention policies, or make your request channel more visible.

Section 12 Defenses: Public Interest, Public Figures, and Legal Retention

The most common mistake news outlets make under Section 12 is capitulating to erasure requests without evaluating their retention ground. Section 12’s exception for “retention is required by law” is broad enough to protect news archives if you document your reasoning:

Public Interest Reporting Courts in India and globally have recognized that press freedom and the public’s right to information override individual privacy in news contexts. If you published a story on a matter of legitimate public concern (crime, corruption, disaster, public health threat, financial scandal, political dispute), Section 12 does not require you to erase it just because the subject finds it embarrassing. However, you must actively evaluate whether the data is still necessary for the original purpose. If 20 years have passed and the story has zero ongoing public relevance, erasure or depersonalization may be appropriate.

Public Figures and Newsmakers Politicians, business leaders, celebrities, and public officials have fewer privacy rights than private individuals. Reporting on them—even unflattering or critical reporting—generally justifies retention. The public has a right to know about the conduct of those in power or prominence. However, public figure status is not eternal. A politician who left office 30 years ago and has no ongoing public relevance may be entitled to erasure or depersonalization of old stories. Courts would evaluate whether the public interest in retention outweighs the individual’s privacy interest.

Legal and Regulatory Obligations If a court, tax authority, police agency, or regulator has ordered you to retain records, you must refuse erasure. Document the order and cite it in your response to the data subject. You have a higher legal obligation than Section 12.

Accuracy vs. Embarrassment If a data subject requests you erase a fact because it is embarrassing, but the fact is true and you published it in good faith on a matter of public interest, Section 12 does not require erasure. Section 12 permits correction of inaccurate data, but not deletion of accurate reporting on grounds of embarrassment or reputation.

---

Frequently Asked Questions

Q: If a person in a photograph I published requests erasure of the photo, am I obligated to delete it?

A: Not automatically. Evaluate the context first. If the photo is part of published news reporting on a matter of public interest (a protest, a crime scene, a disaster, a public event), retention is likely justified under Section 12’s exception. Is the person identifiable? Are they a public figure or a private individual? If the person is a bystander whose face is identifiable but irrelevant to the story (a random passerby in the background of a protest photo), you should consider depersonalization (pixelating the face) rather than full erasure. If the person is a private individual with no connection to the news story, erasure of their image is appropriate. Document your reasoning in writing and respond within 30 days.

Q: Can a person demand I erase an entire article just because they are mentioned in it?

A: No. Section 12 grants the right to correct inaccurate data or erase data no longer necessary for the stated purpose. If the article is accurate reporting on a public matter, erasure of the entire article is not justified under Section 12. However, if the article contains a factual error (you misquoted the person, got a date wrong, misidentified them), correction is required. If the article is outdated and has zero ongoing public relevance (a 15-year-old story about a person’s personal life, never republished), erasure or significant depersonalization may be appropriate.

Q: Do archived articles on my website fall under Section 12, or only current articles?

A: Section 12 applies to all personal data, whether archived or current. If an archived article contains identifiable information about an individual, that person can request correction or erasure under Section 12. However, you can refuse erasure if retention is justified (public record, legal obligation, ongoing public interest). Best practice: do not silently delete archived articles. Instead, append a correction note to the article or add a flag indicating that the data has been updated. This preserves the historical record while respecting the individual’s rights.

Q: What if I’m unsure whether I should refuse an erasure request based on public interest?

A: Document your reasoning carefully and respond within 30 days. If you refuse, explain the specific ground (e.g., “This article reports on a matter of public concern”) and offer alternatives (a correction, depersonalization, or a context note). If the data subject disagrees with your decision, they can lodge a complaint with the Data Protection Board of India. The Board will evaluate whether your retention ground was justified. Strong, documented reasoning now makes it much easier to defend your decision later.

Q: How do I handle Section 12 requests from minors or their parents differently?

A: Minors and their parents have additional privacy rights under Section 12. If a parent requests erasure or depersonalization of their minor child’s data (a photo from a school event, a student’s name in a discipline story), you should comply unless retention is required by law. Even for stories in the public interest, minors’ data receives heightened protection. If you reported on a minor’s crime or disciplinary record, evaluate whether the minor’s identity is still necessary for the public interest. If the minor has aged out of the story’s relevance (now an adult, the incident is decades old), erasure or significant depersonalization is appropriate. Document this reasoning: courts and the Data Protection Board will scrutinize how you protect minors’ privacy.