Section 8(7)(b) in THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
(b)cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor.Illustrations.(I)X, an individual, registers herself on an online marketplace operated by Y, an e-commerce service provider. X gives her consent to Y for the processing of her personal data for selling her used car. The online marketplace helps conclude the sale. Y shall no longer retain her personal data.(II)X, an individual, decides to close her savings account with Y, a bank.Y is required by law applicable to banks to maintain the record of the identity of its clients for a period of ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X’s personal data for the said period.