Deleting the Digital Footprint: Legal Remedies under India’s DPDP Act, 2023

INTRODUCTION

Imagine applying for a job and discovering that an embarrassing photograph uploaded years ago still appears prominently on a search engine. Imagine a college student whose private images were shared online without consent, continuing to circulate across websites despite repeated requests for removal. Consider a person acquitted of criminal charges, yet old news reports and online records continue to define their identity in public perception. In the digital age, the internet possesses an almost permanent memory. Information uploaded once can remain accessible indefinitely, often beyond the control of the individual concerned. While technological advancement has transformed communication and access to information, it has simultaneously created serious threats to personal privacy, dignity, and reputation.

The rise of social media platforms, cloud storage, digital archives, and search engines has resulted in the large-scale collection and circulation of personal data. Every online activity—photographs, videos, comments, location history, financial records, and browsing patterns—contributes to an individual’s digital footprint. Unlike human memory, digital memory does not fade with time. Search engines preserve and reproduce information continuously, making even outdated or irrelevant content instantly accessible. As a result, individuals frequently face harassment, reputational damage, mental distress, identity theft, cyberstalking, and social discrimination because of information that they may no longer wish to remain publicly available.

This concern has led to the emergence of the concept known as the “Right to be Forgotten.” Broadly understood, the Right to be Forgotten refers to the right of an individual to demand the removal, deletion, delisting, or erasure of personal information from online platforms when such information is no longer necessary, relevant, accurate, or lawful. The principle seeks to provide individuals greater control over their personal data and digital identity. It is closely connected to the broader right to privacy and human dignity. The idea gained international recognition primarily through European data protection jurisprudence, particularly after the landmark decision of the European Court of Justice in Google Spain v. AEPD and Mario Costeja González (2014), where individuals were granted the ability to request search engines to remove links containing outdated personal information.

In India, the Right to be Forgotten has gradually evolved through constitutional jurisprudence and judicial interpretation. The landmark judgment of the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017) recognized the Right to Privacy as a fundamental right under Article 21 of the Constitution. The judgment emphasized informational privacy and acknowledged that individuals should possess autonomy and control over their personal data. Following this constitutional recognition, debates surrounding data protection and digital privacy gained significant importance in India’s legal framework.

A major legislative development in this regard was the enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act). The Act represents India’s first comprehensive legislation dedicated specifically to personal data protection. Although the Act does not expressly mention the term “Right to be Forgotten,” it introduces several mechanisms that indirectly support the concept, including rights relating to consent management, correction of personal data, withdrawal of consent, and erasure of personal information. The legislation imposes obligations upon data fiduciaries and digital platforms to process personal data responsibly and lawfully. Consequently, individuals are now better equipped to seek the removal of certain personal information from websites, applications, and digital intermediaries.

However, the implementation of the Right to be Forgotten raises several complex legal and ethical concerns. It creates a tension between an individual’s right to privacy and society’s right to information and freedom of expression. Questions often arise regarding whether public records, judicial decisions, journalistic reports, or information concerning public figures should also be erased from digital platforms. Additionally, enforcing removal across global search engines and websites remains technologically and legally challenging due to the borderless nature of the internet.

Against this backdrop, the present article seeks to critically examine the concept of the Right to be Forgotten in the context of India’s evolving data protection regime. The article aims to analyze the meaning and scope of the Right to be Forgotten, trace its development in international and Indian jurisprudence, and examine the legal framework established under the Digital Personal Data Protection Act, 2023. Further, it explores the practical legal remedies available to individuals seeking the removal of private photographs, sensitive information, or harmful online content from search engines and websites. The article also evaluates the challenges involved in balancing privacy rights with freedom of speech and public interest in a democratic society.

In an era where digital footprints can outlive individuals themselves, the recognition and enforcement of the Right to be Forgotten has become increasingly important for safeguarding personal dignity, autonomy, and informational privacy. The issue is no longer merely technological; it is fundamentally connected to human rights, constitutional values, and the future of digital governance in India.

 

1. MEANING OF THE RIGHT TO BE FORGOTTEN

The “Right to be Forgotten” refers to the right of an individual to seek the removal, deletion, erasure, or delisting of personal information from digital platforms, search engines, websites, and online databases when such information is no longer necessary, relevant, accurate, or lawful. In simple terms, it allows a person to regain control over their digital identity and prevent the continued circulation of personal data that may adversely affect their privacy, dignity, reputation, or mental well-being.

The concept emerged from the growing realization that the internet possesses a permanent memory. Information uploaded online can remain accessible indefinitely, even when it has lost relevance over time. Search engines index and reproduce personal data continuously, making old photographs, news reports, videos, and social media posts easily searchable years after their original publication. Consequently, individuals often remain haunted by their digital past despite changes in circumstances, rehabilitation, or acquittal from allegations. The Right to be Forgotten seeks to address this imbalance by enabling individuals to request the removal or restriction of such information.

At its core, the Right to be Forgotten is closely linked with the broader right to privacy and informational self-determination. It recognizes that individuals should have autonomy over how their personal information is collected, processed, stored, and disseminated in the digital sphere. The right becomes particularly significant where online content causes reputational harm, emotional distress, harassment, discrimination, or threats to personal safety.

The Right to be Forgotten is often associated with the “Right to Erasure,” a concept prominently recognized under the European Union’s General Data Protection Regulation (GDPR). Article 17 of the GDPR grants individuals the right to request the erasure of personal data under certain circumstances, such as where:

• the data is no longer necessary for the purpose for which it was collected;
• the individual withdraws consent;
• the data has been unlawfully processed;
• the information is inaccurate or outdated; or
• the continued availability of the data violates privacy rights.

The GDPR significantly influenced global data protection laws and contributed to the recognition of digital privacy rights worldwide, including in India. Although the terminology “Right to be Forgotten” may vary across jurisdictions, the underlying principle remains the same: individuals should not remain permanently burdened by harmful or irrelevant digital information.

One important aspect of the Right to be Forgotten is “search engine delisting.” Delisting refers to the removal of links containing personal information from search engine results so that the information becomes less accessible to the general public. In many cases, the original content may continue to exist on a website, but the search engine is directed to stop displaying it in response to searches involving the individual’s name. This mechanism attempts to balance privacy rights with freedom of information by reducing public visibility without necessarily erasing historical records completely.

The significance of this right becomes evident in various real-life situations. For example, victims of revenge porn or non-consensual sharing of intimate images often seek immediate removal of such content from websites and search engines to protect their dignity and safety. Similarly, individuals who were once accused of crimes but later acquitted may wish to remove old news reports or online records that continue to damage their reputation and employment opportunities. In other cases, leaked private photographs, defamatory posts, fake information, or misleading social media content may continue circulating online despite causing severe personal and professional consequences.

The Right to be Forgotten also plays a crucial role in protecting vulnerable individuals such as women, children, and victims of cyber harassment. In many instances, morphed photographs, unauthorized videos, or personal details are uploaded online without consent, leading to blackmail, trolling, stalking, and psychological trauma. Since digital content can spread rapidly and remain permanently archived, the availability of legal mechanisms for removal becomes essential to preserving human dignity and privacy.

However, the Right to be Forgotten is not an absolute right. Its enforcement often requires balancing competing interests, including freedom of speech, freedom of the press, public interest, and the public’s right to access information. For instance, information relating to public officials, criminal convictions involving public safety, or matters of historical importance may not always qualify for removal. Courts and regulators therefore attempt to balance individual privacy with democratic transparency and accountability.

In the Indian context, the Right to be Forgotten has not yet been explicitly codified as a standalone statutory right. Nevertheless, Indian courts have increasingly recognized its importance through judicial decisions relating to privacy, dignity, and protection of personal data. The enactment of the Digital Personal Data Protection Act, 2023 has further strengthened the legal framework for informational privacy by introducing rights relating to data correction, consent withdrawal, and data erasure.

Thus, the Right to be Forgotten represents an evolving legal response to the challenges posed by the digital age. It reflects the growing recognition that while technology has enabled unprecedented access to information, individuals must also possess the ability to protect themselves from the permanent and harmful consequences of unwanted digital exposure.

 

2. EVOLUTION OF THE RIGHT TO BE FORGOTTEN

The Right to be Forgotten emerged as a legal response to the rapid expansion of the internet and the permanent accessibility of personal information online. With the growth of search engines, social media platforms, and digital archives, individuals increasingly found themselves unable to escape outdated, irrelevant, or harmful information available on the internet. Consequently, concerns regarding privacy, dignity, and informational autonomy led several jurisdictions, particularly in Europe, to recognize a person’s right to control the circulation of personal data in the digital environment.

(a) Development in the European Union

The European Union played a pioneering role in the recognition and development of the Right to be Forgotten. European privacy law has historically emphasized the protection of human dignity and personal autonomy. Unlike some jurisdictions that prioritize unrestricted access to information, European legal systems have consistently treated privacy as a fundamental human right deserving strong legal safeguards.

A landmark moment in the evolution of the Right to be Forgotten occurred in the case of Google Spain SL v. Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (2014), decided by the European Court of Justice (ECJ). This case became the foundation of modern digital privacy jurisprudence.

Google Spain v. AEPD and Mario Costeja González (2014)

The dispute arose when Mario Costeja González, a Spanish citizen, discovered that a Google search of his name produced links to newspaper articles published many years earlier concerning his financial debts and property auction proceedings. Although the matter had long been resolved, the information remained easily accessible through Google’s search results, adversely affecting his reputation and privacy. González argued that the continued indexing of this outdated information violated his privacy rights and requested that Google remove the links from search results associated with his name.

The European Court of Justice ruled in favor of González and held that search engines such as Google are “data controllers” because they collect, organize, store, and display personal information. The Court further observed that individuals have the right to request the removal of links containing personal information when such information is “inadequate, irrelevant, no longer relevant, or excessive” in relation to the purpose for which it was processed.

As a result, Google was directed to remove or delist certain search results connected to González’s name. Importantly, the judgment clarified that the removal obligation applied to search engine results rather than necessarily deleting the original content from the source website itself. This mechanism became known as “search engine delisting.”

The judgment was revolutionary because it recognized that unrestricted digital access to outdated personal information could seriously harm an individual’s dignity, social standing, and private life. It also acknowledged that search engines significantly amplify the visibility of personal information and therefore bear responsibility for balancing public access to information with privacy rights.

The Google Spain judgment established several important principles:

• individuals possess greater control over personal data online;
• privacy rights may outweigh public interest in certain circumstances;
• search engines can be legally compelled to delist personal information; and
• outdated or irrelevant information should not remain permanently accessible merely because it once existed online.

Following this judgment, search engines across Europe introduced formal mechanisms allowing individuals to submit requests for the removal of search results containing personal information.

 

 

(b) The General Data Protection Regulation (GDPR)

The recognition of the Right to be Forgotten received further legal reinforcement through the enactment of the General Data Protection Regulation (GDPR) by the European Union in 2018. The GDPR is considered one of the world’s most comprehensive data protection laws and has significantly influenced privacy legislation globally.

Article 17 of the GDPR expressly recognizes the “Right to Erasure,” commonly referred to as the Right to be Forgotten. This provision grants individuals the right to request the deletion or erasure of their personal data under specific circumstances. The regulation aims to ensure that individuals retain meaningful control over how their personal information is collected, stored, processed, and disseminated.

Under Article 17, individuals may request the erasure of personal data where:

• the data is no longer necessary for the purpose for which it was originally collected or processed;
• the individual withdraws consent upon which the processing was based;
• the processing of data is unlawful;
• the individual objects to data processing and there are no overriding legitimate grounds for continuing such processing; or
• the data must be erased to comply with a legal obligation.

The GDPR also imposes obligations upon data controllers to take reasonable steps to inform other entities processing the data that the individual has requested deletion of links, copies, or replications of such information. Consequently, the regulation significantly strengthened the enforcement of digital privacy rights within the European Union.

However, the Right to Erasure under the GDPR is not absolute. The regulation recognizes certain exceptions where deletion requests may be denied, particularly when data processing is necessary for:

• freedom of expression and information;
• public interest;
• scientific or historical research;
• legal claims; or
• compliance with legal obligations.

Thus, the GDPR attempts to balance individual privacy rights with competing democratic interests such as transparency, media freedom, and public access to information.

The European Union’s approach has profoundly influenced global discussions on digital privacy and data protection. Several countries, including India, have drawn inspiration from European jurisprudence while developing their own privacy frameworks. The recognition of informational autonomy, consent-based data processing, and the ability to seek erasure of personal information has become increasingly relevant in the age of social media, artificial intelligence, and large-scale digital surveillance.

Therefore, the evolution of the Right to be Forgotten in Europe laid the foundation for modern data protection law worldwide. It transformed privacy from a purely personal concern into a legally enforceable digital right and established the principle that individuals should not remain indefinitely burdened by harmful or outdated online information.

 

3. RIGHT TO PRIVACY IN INDIA

The development of the Right to be Forgotten in India is closely connected with the constitutional recognition of the Right to Privacy. Although the Indian Constitution does not expressly mention the word “privacy,” Indian courts have gradually interpreted privacy as an essential component of the right to life and personal liberty guaranteed under Article 21 of the Constitution. Over time, judicial interpretation expanded the meaning of Article 21 to include the protection of dignity, autonomy, and individual freedom, thereby laying the groundwork for informational privacy in the digital age.

In earlier years, the Indian judiciary dealt with privacy concerns in limited contexts such as unlawful surveillance, telephone tapping, and intrusion into personal life. However, there was no clear and authoritative declaration recognizing privacy as an independent fundamental right. This constitutional uncertainty continued until the landmark judgment of the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017).

Justice K.S. Puttaswamy v. Union of India (2017)

The case arose from challenges to the Aadhaar scheme introduced by the Government of India, which involved the collection and storage of biometric and demographic data of citizens. Petitioners argued that large-scale data collection by the State violated individual privacy and personal liberty. During the proceedings, an important constitutional question emerged: whether the Right to Privacy was protected under the Indian Constitution.

A nine-judge bench of the Supreme Court unanimously held that the Right to Privacy is a fundamental right protected under Article 21 and other freedoms guaranteed by Part III of the Constitution. The Court observed that privacy is intrinsic to human dignity, liberty, and autonomy. It emphasized that every individual possesses the right to make personal decisions free from unnecessary State interference.

The judgment is considered one of the most significant constitutional decisions in Indian legal history because it transformed privacy from a limited judicial concept into a constitutionally protected fundamental right. The Court recognized that privacy is not merely the right to be left alone but also includes control over personal information and decisional autonomy.

One of the most important contributions of the Puttaswamy judgment was its recognition of “informational privacy.” The Court acknowledged that in the modern digital era, personal data has become a valuable and vulnerable asset. Governments, corporations, search engines, and online platforms collect and process enormous amounts of personal information, including financial details, health records, browsing history, biometric information, photographs, communication records, and social media activity. The Court warned that the uncontrolled use of such data could threaten individual liberty and dignity.

The Supreme Court observed that individuals should possess control over the dissemination and use of their personal information. Informational privacy therefore includes the right of individuals to determine:

• what personal data may be collected;
• how such data may be used;
• who may access it; and
• when such information should be removed or restricted.

This recognition became highly significant in the context of digital privacy and online reputation. The Court acknowledged that technological developments had created new forms of privacy invasion, including cyberstalking, data profiling, unauthorized sharing of personal photographs, surveillance, and permanent online records. Consequently, constitutional protection of privacy became essential to safeguard citizens from misuse of personal information in the digital environment.

The Puttaswamy judgment also referred to international privacy developments, including European data protection principles and the concept of informational self-determination. Although the Court did not explicitly define the Right to be Forgotten as an independent right, several observations within the judgment supported the idea that individuals should have greater control over their digital existence and personal data.

The recognition of privacy as a fundamental right laid the constitutional foundation for the Right to be Forgotten in India. By affirming informational privacy and individual autonomy, the Supreme Court created a legal basis upon which individuals could seek protection against the continued circulation of harmful, irrelevant, or unwanted personal information online.

Following the Puttaswamy decision, Indian High Courts increasingly began addressing issues relating to online privacy, removal of personal information, and search engine delisting. Courts recognized that unrestricted digital exposure could adversely affect an individual’s reputation, dignity, mental health, and social standing. Consequently, judicial discourse surrounding the Right to be Forgotten started gaining momentum in India.

The constitutional recognition of privacy also accelerated legislative efforts toward establishing a comprehensive data protection framework in India. It ultimately influenced the enactment of the Digital Personal Data Protection Act, 2023, which seeks to provide individuals greater control over their personal data and strengthen accountability in digital data processing.

However, despite constitutional recognition of privacy, the Right to be Forgotten in India remains an evolving concept. Indian courts continue to balance privacy rights against competing constitutional values such as freedom of speech, transparency, freedom of the press, and the public’s right to information. This balancing exercise becomes particularly complex in cases involving public records, judicial decisions, criminal proceedings, or matters of public importance.

Nevertheless, the Puttaswamy judgment remains the cornerstone of India’s digital privacy jurisprudence. It established that privacy is indispensable to human dignity and democratic freedom and affirmed that constitutional protections must evolve alongside technological advancements. In doing so, the judgment laid the essential constitutional and philosophical basis for recognizing the Right to be Forgotten within India’s legal framework.

 

4. DPDP ACT, 2023 AND THE RIGHT TO BE FORGOTTEN

The enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) represents a significant milestone in India’s evolving digital privacy framework. The legislation was introduced to regulate the processing of digital personal data and to provide individuals greater control over how their information is collected, stored, used, and shared online. Although the Act does not expressly use the phrase “Right to be Forgotten,” several of its provisions indirectly support and strengthen this concept by recognizing rights relating to consent, correction, and erasure of personal data.

The DPDP Act was enacted in response to increasing concerns regarding cyber harassment, unauthorized circulation of personal information, misuse of personal data, and the growing dependence upon digital platforms in everyday life. In the contemporary digital environment, social media companies, search engines, e-commerce platforms, applications, and government agencies process enormous quantities of personal data on a daily basis. Consequently, the legislation seeks to balance technological advancement and innovation with the protection of privacy, dignity, and informational autonomy of individuals.

Under the DPDP Act, the individual whose personal data is being processed is referred to as the “Data Principal.” In simple terms, the Data Principal is the owner of the personal data. Any person whose photographs, videos, contact details, browsing history, online activity, or identity-related information is collected and processed by digital platforms falls within this definition. The Act grants several rights to Data Principals so that they may exercise greater control over their digital identity and personal information.

On the other hand, entities that determine the purpose and means of processing personal data are known as “Data Fiduciaries.” Social media platforms such as Instagram, Facebook, and YouTube, along with search engines like Google, function as Data Fiduciaries because they collect, store, and process user information. The Act imposes legal obligations upon such entities to process personal data in a fair, lawful, and responsible manner.

One of the foundational principles of the DPDP Act is consent-based data processing. The Act provides that personal data should generally be processed only after obtaining free, informed, specific, and unambiguous consent from the Data Principal. Consent is important because it recognizes that individuals should possess autonomy over their personal information. If a person no longer wishes a platform to retain or process certain data, withdrawal of consent may trigger obligations relating to deletion or cessation of processing. This principle becomes particularly relevant in cases involving leaked private photographs, non-consensual intimate images, unauthorized publication of personal information, or misuse of personal data for commercial purposes.

A particularly significant aspect of the DPDP Act is the right relating to correction and erasure of personal data. The legislation enables individuals to seek correction of inaccurate information, completion of incomplete data, updating of outdated records, and erasure of personal data that is no longer necessary. The right to erasure closely resembles the concept of the Right to be Forgotten because it allows individuals to demand greater control over harmful or unwanted digital information. A Data Principal may request deletion of personal data where the purpose for which the data was collected no longer exists, where consent has been withdrawn, or where retention of the data becomes unnecessary or unlawful.

The Act also imposes several obligations upon Data Fiduciaries to ensure responsible handling of personal information. These obligations include maintaining reasonable security safeguards, preventing data breaches, erasing data after the purpose of processing has been fulfilled, and establishing grievance redressal mechanisms. Data Fiduciaries are further required to publish contact details of grievance officers so that affected individuals may submit complaints regarding misuse or unauthorized processing of personal data. Such mechanisms become particularly important where websites refuse to remove harmful content, fake profiles circulate personal images, or leaked private photographs continue to remain accessible online.

The constitutional basis for these protections can be traced to the landmark judgment of Justice K.S. Puttaswamy v. Union of India, where the Supreme Court recognized privacy as a fundamental right under Article 21 of the Constitution. The Court acknowledged the importance of informational privacy and individual control over personal data, thereby laying the foundation for future recognition of the Right to be Forgotten in India. The principles established in this case significantly influenced India’s modern data protection framework and continue to guide judicial interpretation concerning digital privacy rights.

Indian courts have further strengthened these protections through subsequent decisions. In Jorawar Singh Mundy v. Union of India, the Delhi High Court dealt with a situation where an acquitted individual sought removal of online judgments and search engine results that continued to damage his professional reputation. The Court directed masking and removal of certain online records, recognizing that perpetual online visibility of acquittal-related information could violate privacy and dignity. Similarly, in X v. Registrar General, High Court of Karnataka, the Karnataka High Court acknowledged a limited form of the Right to be Forgotten by permitting protection of a woman’s identity in sensitive judicial records available online.

Although the DPDP Act does not explicitly codify the Right to be Forgotten as an independent statutory right, it substantially supports the concept through provisions relating to consent withdrawal, correction, and erasure of personal data. The legislation reflects a broader shift toward recognizing informational self-determination and digital autonomy in India. It acknowledges that personal data should not remain permanently accessible merely because it was once uploaded online. In many situations, individuals may suffer severe emotional, reputational, and professional harm because outdated or sensitive information continues circulating indefinitely on the internet.

For instance, victims of revenge porn may seek deletion of intimate images, individuals acquitted of criminal charges may request removal of outdated reports, and users may withdraw consent for continued storage of personal data by applications and websites. Through such protections, the DPDP framework creates legal mechanisms enabling individuals to exercise greater control over their digital identity and online presence.

However, the legislation also raises certain concerns and ambiguities. The Act does not clearly define the exact scope of data erasure, whether search engine delisting is mandatory, or how privacy rights will be balanced against freedom of speech and public interest. Consequently, the practical implementation of the Right to be Forgotten in India continues to depend significantly upon judicial interpretation and future regulatory developments. Nevertheless, the DPDP Act, 2023 represents a substantial step toward strengthening digital privacy protections and lays the foundation for eventual recognition of a comprehensive Right to be Forgotten within the Indian legal system.

 

5. HOW CAN A PERSON LEGALLY FORCE REMOVAL OF PRIVATE INFORMATION?

In the digital age, private photographs, personal videos, outdated records, fake allegations, and sensitive information can spread rapidly across websites, social media platforms, and search engines. Once uploaded online, such content may continue circulating indefinitely, causing reputational harm, emotional distress, harassment, and violations of privacy. Consequently, individuals increasingly seek legal mechanisms through which they may compel the removal of harmful or unwanted digital content.

The first and most immediate remedy available to an individual is to directly approach the website or social media platform hosting the content. Most digital platforms today maintain grievance redressal systems and privacy complaint mechanisms for reporting harmful or unauthorized content. Platforms such as Instagram, Facebook, X (formerly Twitter), and YouTube permit users to report non-consensual intimate images, fake accounts, impersonation, harassment, leaked personal photographs, and privacy violations. A victim may submit screenshots, URLs, proof of identity, and evidence of privacy infringement while requesting removal of the objectionable content. In cases involving revenge porn, morphed images, child sexual abuse material, or explicit content shared without consent, platforms often act urgently because such material violates both platform guidelines and legal obligations.

Another important remedy is search engine delisting. Even if harmful content continues to exist on a website, individuals may request search engines such as Google to remove links appearing in search results associated with their names. This process is known as “delisting.” Search engines generally entertain requests relating to explicit personal images, leaked documents, financial information, fake content, and outdated personal information. Although delisting does not necessarily erase the original content from the internet, it significantly reduces public accessibility and minimizes reputational damage.

The DPDP Act, 2023 further strengthens individual control over personal data by granting rights relating to consent, correction, and erasure. A person may withdraw consent for continued processing of personal data, seek correction of inaccurate information, or request erasure of unnecessary personal information. If a Data Fiduciary continues processing personal data despite lawful requests for deletion or withdrawal of consent, liability may arise under the Act. For example, an application retaining deleted photographs or a platform refusing to remove sensitive personal information may potentially violate obligations imposed under the DPDP framework.

Judicial precedents have also played an important role in protecting online privacy. In Jorawar Singh Mundy v. Union of India, the Delhi High Court recognized that continued accessibility of acquittal-related judgments on search engines could seriously affect an individual’s career and reputation. The Court therefore directed removal and masking of the judgment from online platforms. Similarly, in X v. Registrar General, High Court of Karnataka, the Karnataka High Court emphasized that sensitive personal information, particularly relating to women involved in matrimonial disputes, should not remain permanently searchable online.

In situations where platforms refuse to remove harmful content, individuals may approach courts for legal remedies. A writ petition may be filed before the High Court under Article 226 of the Constitution seeking protection of privacy, dignity, reputation, and informational autonomy. Indian courts have increasingly recognized that unrestricted online circulation of harmful information may violate the fundamental right to privacy under Article 21. Civil courts may also grant injunctions restraining publication or circulation of private photographs, intimate videos, defamatory material, or confidential information. Courts may order deletion of content, removal of URLs, or blocking of websites where necessary.

Apart from civil remedies, victims may also file cyber crime complaints in cases involving revenge porn, cyberstalking, fake social media profiles, online blackmail, morphed photographs, and non-consensual circulation of intimate images. Complaints may be submitted before cyber crime police stations or through the National Cyber Crime Reporting Portal. Relevant legal provisions under the Information Technology Act, 2000, such as Section 66E relating to violation of privacy, Section 67 concerning obscene material, and Section 67A dealing with sexually explicit content, may apply in such cases. Additionally, provisions relating to defamation, harassment, stalking, and criminal intimidation under the Bharatiya Nyaya Sanhita may also become applicable depending upon the circumstances.

Therefore, Indian law now provides multiple legal and practical mechanisms through which individuals may seek removal of harmful personal information online. Although technological and enforcement challenges continue to exist, the combined use of platform grievance systems, search engine delisting, DPDP rights, judicial remedies, and cyber law protections has significantly strengthened digital privacy safeguards in India.

 

 

6. IMPORTANT INDIAN CASES

Indian courts have gradually recognized the importance of protecting informational privacy and digital dignity in the internet era. Although the Right to be Forgotten has not yet been expressly codified as a separate statutory right in India, several judicial decisions have acknowledged the need to protect individuals from the continued circulation of harmful, irrelevant, or sensitive personal information online.

One of the most significant judgments in this regard is Justice K.S. Puttaswamy v. Union of India. In this landmark case, the Supreme Court unanimously recognized the Right to Privacy as a fundamental right under Article 21 of the Constitution of India. The Court emphasized that privacy includes informational privacy, personal autonomy, and the right of individuals to exercise control over their personal data. Although the judgment did not explicitly define the Right to be Forgotten, it laid the constitutional foundation for its future recognition in India. The decision acknowledged that in the digital age, unrestricted collection and circulation of personal information can seriously threaten human dignity and liberty.

Another important case is Jorawar Singh Mundy v. Union of India. In this case, the petitioner had been acquitted in a criminal case but discovered that copies of the judgment continued appearing on search engines and legal databases. Despite acquittal, the persistent online availability of the records negatively affected his professional reputation and employment opportunities. Recognizing the harm caused by digital permanence, the Delhi High Court directed the masking and removal of the judgment from search engine results and online legal platforms. The Court observed that individuals who have been acquitted should not continue to suffer social stigma merely because digital records remain permanently accessible online. This judgment significantly strengthened the practical recognition of the Right to be Forgotten in India.

A further important development came in X v. Registrar General, High Court of Karnataka, where the Karnataka High Court recognized a limited form of the Right to be Forgotten. The case involved a woman seeking removal of her name from publicly available court records connected to sensitive matrimonial disputes. The Court accepted that continued online disclosure of her identity violated her privacy and dignity. It emphasized that women involved in sensitive cases should not be forced to suffer lifelong social embarrassment because judicial records remain searchable on the internet. The judgment highlighted the need to balance transparency of judicial proceedings with protection of individual privacy.

Collectively, these judgments demonstrate that Indian courts are increasingly recognizing the importance of informational privacy, digital dignity, and individual control over personal data. They also indicate a gradual judicial movement toward formal recognition of the Right to be Forgotten within the Indian legal system.

 

 

7. CHALLENGES AND LIMITATIONS

Despite its growing importance in modern privacy jurisprudence, the Right to be Forgotten remains one of the most controversial and complex aspects of digital law. While the right seeks to protect human dignity, informational privacy, and reputational interests, its implementation raises several legal, ethical, constitutional, and technological concerns. The challenge primarily lies in balancing an individual’s right to privacy with society’s broader interest in transparency, free speech, and access to information.

One of the most significant challenges is the conflict between the Right to be Forgotten and the constitutional guarantee of freedom of speech and expression under Article 19(1)(a) of the Constitution of India. The removal or suppression of online content may sometimes restrict journalistic freedom, public discussion, and the free flow of information. Critics argue that allowing individuals to erase online information too easily may create a system of private censorship where truthful and lawfully published material disappears merely because it causes embarrassment or reputational discomfort. Consequently, courts must carefully determine whether privacy interests outweigh the public’s right to know.

Another major issue involves the conflict between public interest and individual privacy. Courts often face difficult questions regarding whether certain categories of information should continue to remain publicly accessible despite claims for deletion. For instance, should politicians, public officials, corporate leaders, or convicted criminals be permitted to erase controversial information from public memory? Information relating to corruption, public misconduct, criminal activities, or matters affecting public safety may continue to remain relevant even after many years. In such cases, complete removal of information could undermine democratic accountability and informed public discourse. Therefore, privacy rights cannot always override legitimate public interest.

The Right to be Forgotten also creates tensions with media freedom and freedom of the press. News reports, judicial decisions, and investigative journalism form an important part of historical documentation and democratic transparency. Media organizations often argue that truthful reporting should not be erased merely because an individual later wishes to distance themselves from past events. Permanent deletion of archived reports may affect journalistic integrity, legal transparency, and preservation of historical records. Courts therefore generally adopt a cautious approach while directing removal of news articles or judicial records from digital platforms.

Another serious challenge concerns internet archives and digital permanence. The internet functions through multiple layers of data storage, backups, caches, screenshots, mirror websites, and archived repositories. Even if information is removed from one website or search engine, copies may continue circulating elsewhere. Digital content can easily be downloaded, reshared, or anonymously reposted across numerous platforms within seconds. Consequently, complete erasure of online information often becomes practically impossible. The Right to be Forgotten therefore sometimes provides only partial relief rather than total deletion of harmful content.

Technical difficulties further complicate the enforcement of digital erasure requests. Search engines process billions of webpages globally, making it difficult to monitor and remove every instance of personal information. Algorithms may continue indexing cached or duplicated content despite removal orders. Additionally, identifying whether content is genuinely harmful, outdated, or unlawful often requires complex factual and legal evaluation. Excessive takedown requests may also impose heavy compliance burdens upon digital platforms and intermediaries.

Cross-border data issues represent another major limitation. Most large digital platforms, including search engines and social media companies, operate internationally and store data across multiple jurisdictions. As a result, enforcing Indian privacy orders against foreign entities becomes legally challenging. Questions frequently arise regarding territorial jurisdiction, applicability of Indian law outside India, and enforcement against multinational corporations headquartered abroad. A removal order passed in one country may not automatically bind platforms operating in other jurisdictions. Consequently, the global and borderless nature of the internet significantly limits the effectiveness of domestic privacy enforcement mechanisms.

Another unresolved concern is the absence of clear legal standards regarding the scope and limits of the Right to be Forgotten in India. Since the Digital Personal Data Protection Act, 2023 does not expressly codify the right, courts currently rely heavily upon constitutional principles and case-by-case judicial interpretation. This may lead to inconsistent decisions and uncertainty regarding which categories of information deserve protection.

Therefore, although the Right to be Forgotten represents an important development in digital privacy law, its practical implementation remains highly complex. The challenge lies in creating a balanced framework that protects individual dignity and privacy without undermining freedom of expression, media independence, historical preservation, and public access to information. Achieving this balance will remain one of the most significant legal challenges in the evolving digital era.

 

8. IMPACT OF THE DPDP ACT, 2023

The enactment of the Digital Personal Data Protection Act, 2023 marks a transformative development in India’s digital governance and privacy framework. With the rapid expansion of social media platforms, e-commerce websites, artificial intelligence systems, and digital financial services, personal data has become one of the most valuable resources in the modern digital economy. However, the large-scale collection and misuse of personal information also created serious concerns relating to privacy violations, cyber harassment, identity theft, data breaches, and unauthorized surveillance. In this context, the DPDP Act, 2023 represents an important legislative attempt to strengthen informational privacy and provide individuals greater control over their digital identity.

One of the most significant impacts of the Act is the strengthening of digital privacy protections in India. The legislation formally recognizes that individuals possess rights over their personal data and that organizations handling such data must process it lawfully, fairly, and responsibly. By introducing consent-based processing and rights relating to correction and erasure of data, the Act reinforces the principle that personal information belongs primarily to the individual concerned. This reflects a major shift toward recognizing informational privacy as an essential component of human dignity and personal autonomy in the digital age.

The DPDP Act also increases the accountability of companies and digital platforms processing personal data. Social media companies, applications, websites, financial institutions, and online service providers functioning as Data Fiduciaries are now legally obligated to maintain reasonable security safeguards, prevent data breaches, and process personal data only for legitimate purposes. The law imposes responsibilities regarding transparency, consent management, and grievance redressal mechanisms. Consequently, companies can no longer handle user data without legal responsibility or oversight. This increased accountability is particularly important in an era where private corporations possess enormous quantities of sensitive personal information.

Another important impact of the Act is the empowerment of users and internet consumers. The legislation grants Data Principals several rights, including the right to access information regarding data processing, the right to correction of inaccurate data, the right to withdraw consent, and the right to seek erasure of personal data. These provisions provide individuals greater control over how their personal information is stored, used, and shared online. In practical terms, individuals now possess stronger legal grounds to demand deletion of outdated information, correction of inaccurate records, or cessation of unauthorized data processing. This indirectly supports the emerging concept of the Right to be Forgotten in India.

The DPDP framework may also contribute toward creating a safer online environment. The misuse of personal information, circulation of leaked private photographs, cyberstalking, impersonation, revenge porn, and unauthorized profiling have become increasingly common in the digital era. By imposing obligations upon Data Fiduciaries and recognizing user rights, the Act attempts to reduce negligent handling and unlawful dissemination of sensitive personal data. The requirement to establish grievance redressal mechanisms further enables individuals to seek remedies against misuse of their personal information.

In addition, the legislation may encourage greater public awareness regarding digital privacy and data protection rights. For many years, internet users in India remained largely unaware of how extensively their personal information was being collected and monetized by digital companies. The enactment of a dedicated data protection law highlights the importance of informed consent, cybersecurity, and responsible digital behavior. Over time, this may contribute toward the development of a stronger privacy culture within Indian society.

However, despite these positive developments, the DPDP Act also faces several criticisms and limitations. One major concern relates to enforcement uncertainty. Several operational aspects of the law depend upon future rules, regulatory interpretation, and administrative implementation. Since the practical mechanisms for enforcement are still evolving, questions remain regarding how effectively individuals will be able to exercise their rights in practice.

Another important limitation is that the Act does not expressly recognize the “Right to be Forgotten” as an independent statutory right. Although provisions relating to consent withdrawal, correction, and erasure resemble the concept, the absence of explicit recognition creates legal ambiguity. Consequently, individuals may still need to depend upon constitutional remedies and judicial interpretation for effective enforcement against search engines and digital platforms.

Concerns have also been raised regarding balancing privacy with freedom of speech, journalistic freedom, and public interest. Excessive data removal powers may potentially affect transparency, media reporting, and access to lawful information. Therefore, courts and regulators must ensure that privacy protections do not unintentionally result in censorship or suppression of information relevant to democratic accountability.

Additionally, practical enforcement against multinational digital corporations remains difficult because most online platforms operate across multiple jurisdictions. Cross-border data transfers, foreign servers, and global internet architecture continue to create significant challenges for effective implementation of Indian privacy laws.

Nevertheless, the DPDP Act, 2023 represents a historic step in India’s evolving digital privacy regime. Although the law may still require further clarification and stronger enforcement mechanisms, it establishes the foundation for a more rights-based approach toward personal data protection. Most importantly, the legislation reflects a growing recognition that in the digital era, individuals must possess meaningful control over their personal information, dignity, and online identity.

 

 

9. SUGGESTIONS AND WAY FORWARD

The Right to be Forgotten is an important step toward protecting individual dignity and privacy in the digital age. However, its implementation in India requires a balanced and carefully regulated approach. Since the internet preserves information permanently, individuals often suffer continuous harm due to outdated, misleading, or irrelevant content. Therefore, India must develop a strong legal and institutional framework that protects privacy while also preserving freedom of speech and public interest.

Firstly, India should enact clear and comprehensive laws specifically recognizing the Right to be Forgotten. Although the Digital Personal Data Protection Act, 2023 provides certain rights relating to data erasure, there is still no dedicated legislation that comprehensively defines the scope, limitations, and enforcement mechanism of this right. A clear statutory framework would reduce ambiguity and ensure uniform judicial interpretation.

Secondly, courts and regulatory authorities should adopt a balanced approach between privacy and freedom of expression. Information involving public interest, serious crimes, corruption, public office holders, or matters affecting society should not be easily erased merely on personal request. At the same time, private individuals should be protected from unnecessary public exposure arising from outdated or irrelevant information. Therefore, a case-by-case proportionality test should be followed.

Thirdly, India should establish an independent data protection authority to handle complaints related to online privacy and data erasure efficiently. A specialized authority can help reduce the burden on courts and provide faster remedies to individuals seeking removal of harmful digital content.

Another important suggestion is the development of stronger obligations for intermediaries and search engines. Digital platforms should create transparent mechanisms through which individuals can request removal or de-indexing of personal information. Such requests must be processed within a reasonable time while ensuring accountability and transparency.

Further, public awareness regarding digital privacy must be increased. Many individuals are unaware of their rights concerning personal data protection. Educational campaigns, digital literacy programs, and awareness initiatives can help citizens understand the risks associated with online data sharing and misuse.

International cooperation is also essential because digital information flows across national borders. India should collaborate with global institutions and adopt international best practices, particularly from frameworks such as the European Union’s GDPR, while tailoring them to Indian constitutional values and societal needs.

Lastly, technological safeguards such as stronger encryption, privacy-by-design mechanisms, and secure data management practices should be encouraged. Companies collecting personal data must ensure that data is stored responsibly and deleted when no longer necessary.

In conclusion, the Right to be Forgotten has the potential to strengthen informational privacy and individual autonomy in India. However, its successful implementation depends upon striking a balance between privacy, transparency, freedom of speech, and public interest. With proper legal safeguards, institutional mechanisms, and responsible digital governance, India can effectively protect citizens’ digital dignity in the evolving information society.

 

 

 

 

 

10. CONCLUSION

The Right to be Forgotten has emerged as one of the most significant privacy rights in the digital era. In a world where personal information can remain accessible indefinitely through search engines and online platforms, individuals often face reputational harm, emotional distress, and violations of dignity due to outdated, irrelevant, or misleading information. The recognition of privacy as a fundamental right in Justice K.S. Puttaswamy v. Union of India laid the constitutional foundation for the development of this right in India.

International developments, particularly the European Union’s recognition of the “Right to Erasure” under the GDPR and the landmark decision in Google Spain v. AEPD and Mario Costeja González, have greatly influenced global discussions on digital privacy. Indian courts have also gradually acknowledged the importance of protecting informational privacy by permitting removal or masking of sensitive personal information in appropriate cases.

However, the Right to be Forgotten is not absolute. Its implementation raises complex issues involving freedom of speech, public interest, media freedom, transparency, and access to information. Excessive removal of online content may lead to censorship and undermine democratic accountability. Therefore, a careful balance must be maintained between an individual’s right to privacy and society’s right to know.

The Digital Personal Data Protection Act, 2023 marks an important step toward strengthening data protection in India by recognizing certain rights relating to correction and erasure of personal data. Nevertheless, India still requires clearer legal standards, effective enforcement mechanisms, and comprehensive guidelines specifically dealing with the Right to be Forgotten.

In conclusion, the Right to be Forgotten reflects the growing need to preserve human dignity and personal autonomy in the digital age. As technology continues to evolve, India must adopt a balanced and rights-oriented approach that protects individual privacy without compromising freedom of expression and public interest. A well-regulated framework can ensure that citizens are able to move forward in life without being permanently burdened by their digital past.

 

:

REFERENCES

Cases

1. Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.
2. Google Spain SL v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González (2014) C-131/12, Court of Justice of the European Union.
3. X v Registrar General, High Court of Karnataka 2017 SCC OnLine Kar 424.
4. Zulfiqar Ahman Khan v Quintillion Business Media Pvt Ltd 2019 SCC OnLine Del 8494.
5. Jorawar Singh Mundy v Union of India 2021 SCC OnLine Del 2306.

 

Statutes and International Instruments

1. The Constitution of India, art 21.
2. Digital Personal Data Protection Act 2023.
3. General Data Protection Regulation (EU) 2016/679, art 17.

 

Books and Articles

1. Gautam Bhatia, The Transformative Constitution (HarperCollins India 2019).
2. Usha Ramanathan, ‘Privacy, Security and the Right to Information’ (2016) 51(50) Economic and Political Weekly.
3. Justice B N Srikrishna Committee Report, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (2018).

 

Websites

1. Ministry of Electronics and Information Technology, ‘Digital Personal Data Protection Act, 2023’ https://www.meity.gov.in accessed 28 May 2026.
2. European Union, ‘General Data Protection Regulation (GDPR)’ https://eur-lex.europa.eu accessed 28 May 2026.
3. SCC Online https://www.scconline.com accessed 28 May 2026.