Skip to content

Playbook · 6 steps

Right to Erasure

Also called: Right to be forgotten · Right to deletion · Erasure request · Data deletion request

6steps

Level
Practitioner
Reading time
About 7 min

Reviewed

Definition
A person's right to have their personal data deleted on request, under section 12 of India's DPDP Act and article 17 of GDPR.

01 · How it works, in 6 steps

How does the right to erasure work?

  1. 1

    Take the request on any channel

    Accept requests in chat, by email or through a form, and log the date received. On WhatsApp, "please delete my details" is a request even if it cites no law; route it to an erasure queue, not to the marketing Opt-out keyword handler.

  2. 2

    Confirm who is asking

    Check the requester controls the number or account before deleting anything — a reply from the same WhatsApp number or a one-time code — so a stranger cannot erase someone else's records. Ask for no more data than verification needs.

  3. 3

    Map every copy

    Look the person up by wa_id, business-scoped user ID and email across the CRM, inbox, helpdesk, analytics, data warehouse, logs, backups and each processor. A data map written in advance makes this a lookup, not an investigation.

  4. 4

    Delete, or keep only what a law requires

    Erase contact fields, transcripts, stored media and audience memberships. Where a law requires a record — a GST invoice, a KYC file — keep that record, restrict who can see it and mask the identifiers it does not need.

  5. 5

    Instruct processors and suppress

    Tell the BSP and other processors to erase and record their confirmations. Add a keyed-hash entry to the Suppression List so a future CSV import or ad lead cannot bring the number back.

  6. 6

    Close the loop

    Reply to the person with what was deleted, what was kept and why, then log the request, actions and dates in an audit trail that itself holds no more personal data than it needs.

02Try it

Hands-on: use the controls to work through it yourself.

What is left of a record you must keep?

Masking hides personal data before it reaches logs and dashboards, while keeping enough to recognise it.

Try

Text with email addresses or phone numbers.

Retained copy with identifiers masked
INV/26/0412 · GST invoice · Priya Nair · +•• ••••• •2345 · p•••@example.com
Emails
1
Numbers
1
  • Masked 1 email address and 1 phone or long number.
  • Emails keep their first letter and domain, so support can still tell them apart.
  • Numbers keep their last 4 digits — enough to confirm with a customer, useless to a fraudster.
  • Masking is one-way: do it before text reaches logs, analytics or exports.
Pick a record a business may have to retain after an erasure request — an invoice line, an audit entry, a KYC note — and watch its contact details masked. Masking limits what retained records expose; it is not erasure.

03What is the right to erasure?

The right to erasure is a person's right to have a business delete the personal data it holds about them. India's Digital Personal Data Protection Act (DPDP Act) grants it in section 12, alongside correction and updating, for data the person consented to share; the EU's General Data Protection Regulation (GDPR) grants it in article 17, where it is also called the right to be forgotten. In DPDP terms the person asking is the Data Principal, and the business that decides how the data is used must act on the request.

On a WhatsApp programme the data lives in more places than people expect: contact and consent fields in the CRM, chat transcripts and media in the team inbox, template variables and webhook payloads in application logs, campaign audiences in analytics, and copies held by the BSP or any other Data Processor that runs part of the integration. Meta keeps Cloud API message data for at most 30 days as a processor, and the chat history on the customer's own phone is theirs: no API call removes a delivered message from their device.

Erasure is not absolute. Under DPDP section 12(3) a business erases on request unless keeping the data is necessary for the purpose it was given or to comply with a law — a tax invoice, a KYC record a regulator requires — and GDPR article 17(3) lists similar exceptions such as legal obligations and legal claims. That is different from Data Retention, which deletes data on a schedule once its purpose ends; the right to erasure is deletion on an individual's request, and it starts a clock.

Key takeaways

  • The right to erasure lets a person ask a business to delete their personal data; DPDP section 12 and GDPR article 17 both grant it.
  • Erasure must reach every copy: CRM, inbox, analytics, logs, backups and each vendor that processes the data for you.
  • Data a law requires you to keep, such as tax invoices, may be retained, but only that data and only for that purpose.
  • DPDP data-principal rights apply from 13 May 2027 under the DPDP Rules 2025; GDPR's right already applies to people in the EU.
  • Keep a keyed-hash suppression entry after erasure so a deleted contact is never re-imported and messaged again.

04 · In code

The right to erasure in code

import crypto from "node:crypto";
 
const GRAPH = "https://graph.facebook.com/v26.0";
 
// Keyed hash kept after erasure: a plain SHA-256 of a 10-digit
// mobile number can be brute-forced, an HMAC with a secret cannot.
const suppressionKey = (waId) =>
  crypto.createHmac("sha256", process.env.SUPPRESSION_PEPPER).update(waId).digest("hex");
 
export async function eraseContact({ requestId, waId }) {
  const report = { requestId, deleted: [], retained: [] };
 
  // 1. Media your business uploaded for this person (e.g. a personalised PDF)
  for (const mediaId of await db.media.idsFor(waId)) {
    const res = await fetch(`${GRAPH}/${mediaId}`, {
      method: "DELETE",
      headers: { Authorization: `Bearer ${process.env.ACCESS_TOKEN}` },
    });
    if (res.ok) report.deleted.push(`media:${mediaId}`);
  }
 
  // 2. Your own systems
  report.deleted.push(...(await crm.deleteContact(waId)));
  report.deleted.push(...(await inbox.deleteTranscripts(waId))); // text + stored files
  report.deleted.push(...(await analytics.deleteUser(waId)));
 
  // 3. Records a law requires: keep, restrict, mask
  for (const invoice of await billing.invoicesFor(waId)) {
    await billing.restrictAndMask(invoice.id); // keep the invoice, drop phone/email
    report.retained.push({ record: invoice.id, reason: "Tax record required by law" });
  }
 
  // 4. Processors, then suppression so the number is never re-imported
  await processors.requestErasure(waId, requestId); // BSP, helpdesk, CDP vendors
  await db.suppression.upsert({ key: suppressionKey(waId), scope: "all", reason: "erased" });
 
  await auditTrail.write({ requestId, completedAt: new Date().toISOString(), ...report });
  return report;
}

Only media your business uploaded can be deleted through the Cloud API; everything else lives in your own systems and your processors' systems.

05Example: A Kochi dental chain's deletion request

A patient writes "please delete all my details" to a Kochi dental chain's WhatsApp number. The bot recognises a data request rather than a STOP, pauses marketing at once and opens an erasure ticket. The front-office lead confirms the request came from the patient's own number, and the erasure job runs: the CRM profile, three chat transcripts, two X-ray images saved from the inbox, campaign audiences and analytics events are deleted, and the BSP confirms its copy is gone. The chain keeps the tax invoices the law requires and the treatment records health rules require, masks the phone number in its retained logs, and stores a keyed hash of the number on its suppression list. The patient receives a reply listing what was deleted, what was kept and the reason for each.

06 · Mistakes to avoid

Common mistakes with the right to erasure

  • Deleting the CRM row and stopping there

    Copies in logs, exports, analytics and vendor systems survive. Keep a data map of every store that holds WhatsApp contact data and make the erasure job walk all of it.

  • Treating erasure as an opt-out

    An opt-out stops messages; erasure removes data. Handle STOP and "delete my data" as different intents — and remember that erasure must stop the messages too.

  • Re-importing the person next month

    A fresh CSV from a sales team or an ad lead form brings the number straight back. Check every import against the suppression entry created at erasure.

  • Calling a plain hash anonymous

    A mobile number hashed with plain SHA-256 can be reversed by trying every possible number. Use a keyed hash (HMAC with a secret) and still treat the hash as personal data.

  • Erasing records a law requires

    Deleting a tax invoice to satisfy a request swaps one compliance failure for another. Retain what the law requires, restrict access to it and tell the person why it was kept.

07 · Key facts

The right to erasure: key facts and limits

India
DPDP Act 2023, section 12 (erasure on request) and section 8(7)
European Union
GDPR article 17, applying since 25 May 2018
DPDP commencement
Data-principal rights apply from 13 May 2027
GDPR response time
One month, extendable by two further months
DPDP grievances
Answered within 90 days at most (DPDP Rules 2025)
Meta's copy
Cloud API message data kept for at most 30 days
Uploaded media
Expires after 30 days; DELETE /{MEDIA_ID} removes it sooner

08 · Why it matters

Why does the right to erasure matter?

An erasure request tests whether you actually know where your customers' data lives. A business that deletes the CRM record but leaves the number in a broadcast list, a log file and a vendor's export has not erased anything, and the next campaign proves it — the customer who asked to be forgotten receives an offer. The DPDP Act also makes the business cause its processors to erase, and the Act's schedule allows penalties of up to 50 crore rupees for breaches not separately listed. A tested, logged erasure job turns a legal risk into a routine ticket.

09 · Pro tips

Best practices for the right to erasure

  • Write the data map before the first request arrives, listing every system and processor that holds WhatsApp data.
  • Give the erasure job a dry-run mode that reports what it would delete before it deletes.
  • Send the confirmation on the channel the request came in on.
  • Let backups age out on a known schedule, and never restore an erased contact into live systems.

10Right to Erasure FAQs

Can a customer ask a business to delete their WhatsApp chat history?+
Yes, they can ask a business to erase the data it holds, including transcripts in its inbox and CRM. The copy on the customer's own phone is theirs to delete; no API call removes a delivered message from their device.
Is the right to erasure in force in India yet?+
Not yet: under the DPDP Rules 2025, data-principal rights including erasure apply from 13 May 2027. Many businesses build the process now, and GDPR's right already applies to people in the EU.
How long does a business have to complete an erasure request?+
Under GDPR, one month, extendable by two months for complex requests. The DPDP Rules 2025 require grievances to be answered within 90 days at most, and processors must be made to erase as well.
Can a business refuse to delete my data?+
Only in part, where a law requires the data or it is still needed for the purpose you gave it. Under DPDP section 12(3) and GDPR article 17(3) it keeps only that data and should tell you why.
What is the difference between the right to erasure and data retention?+
Erasure is deletion on an individual's request; data retention is deletion on a schedule once data's purpose ends. A business needs both: a retention schedule for everyone and an erasure process for each request.

See InfiQ pricing

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms