Section 8(7)(a) in THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
(a)erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and