The Right to be Forgotten | How Delhi HC rewrote the India’s Digital Privacy Landscape
Introduction
In an extensive order of 144 pages passed on May 29, 2026, Justice Sachin Datta of the Delhi High Court inter alia affirmed the right of an acquitted or discharged person to reinstate their digital identity. In a batch of more than 30 petitions relating to acquittals, family dispute cases, quashed criminal cases, and parties to proceedings, the petitioners argued that court documents and accusations, having lost their purpose, have kept occupying the search engine, leading to infringement of dignity, privacy, and career and personal life of these individuals. Citing Article 21 of the Indian Constitution as its foundation, the court affirmed that a right to life and personal liberty also includes a right to privacy and to leave behind failed proceedings and adopted wide de-indexing policies, including, where necessary, global de-indexing, thereby ushering in India's "right to be forgotten."
The Constitutional Argument: Article 21 and the Digital Self
The constitutional basis of the right to be forgotten in India rests on the landmark nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India. In 2017, the Supreme Court ruled privacy to be a fundamental right under Article 21 of the Constitution and stated informational privacy is a facet of personal liberty. The Supreme Court observed that individuals have an interest in determining how the information concerning them is gathered, disseminated, and accessed.
Building upon this precedent, Justice Sachin Datta held that the right to be forgotten flows naturally from the constitutional guarantee of informational privacy. The judgment represents one of the most significant judicial applications of the Puttaswamy principles, particularly in the context of search engines and online judicial records. Noting the absence of a fully operational statutory framework despite the enactment of the Digital Personal Data Protection Act, 2023, the court exercised its constitutional jurisdiction to protect individuals from enduring digital harm caused by continued public accessibility of outdated or irrelevant personal information.
INDIAN APPLICATION OF THE GLOBAL PRECEDENT
Tracing back the genesis of this right, it lies in the worldwide jurisdiction on privacy, especially the European Court of Justice's landmark ruling of 2014 in Google Spain SL v. AEPD and Mario Costeja Gonzlez, where it ruled that it is within one's power to ask search engines to de-list links that show personal information that is found to be outdated or irrelevant. This led to a legislated right to erasure by the inclusion of Article 17 in the General Data Protection Regulation (GDPR), creating the right throughout the EU. India, on the other hand, saw a slow process of evolution when it came to this right. The Madras High Court acknowledged the right to be forgotten partially in 2021 when it directed a petitioner's name to be deleted from an acquittal judgment, which was affirmed by a Division Bench in 2024. Nevertheless, the above were merely judgments confined to the facts of a particular case. However, the decision of the Delhi High Court dated May 2026 proves to be the benchmark in laying down a comprehensive constitutional framework under Article 21 with guiding principles on when a request for de-linking would be entertained and, if warranted, would be extended throughout the world.
Anatomy of the Framework by the Delhi High Court
While Justice Sachin Datta’s ruling recognizes the right to be forgotten, its actual import lies in devising an operative framework. The Court noted that it would maintain judicial records indefinitely in keeping with open justice principles, but an individual's name may not act as a perennial search key with respect to private entities' search engines. Thus, courts will be allowed to de-index judicial records (except their legal reasoning, findings, and ratio decidendi, which will continue to be accessible) from the names appearing therein from search engines and legal databases. While personally identifying data will be obfuscated, the underlying legal reasoning will not be rendered unusable, as access to unredacted records will continue to be available to courts, parties, and authorities. Such orders are also possible to be effective internationally, rendering avoidance difficult. However, the right cannot be absolute, as it is largely unavailable for convicted individuals (particularly if convicted of offenses against women or children or crimes of breach of trust). Courts must pass a proportionality test in considering the balance between privacy and the public right to know. By stating that masking information has an impact on discoverability, not access, it achieves a reconciliation between informational privacy and open justice so that acquitted accused are not held hostage to past accusations forever in the online age.
The Road to Implementation
However, the judgment presents a thick knot of practical issues, the solution to which may take considerable time to untangle. How will petitions for masking orders be filed by those who need them? Will there be a prescribed form? How will legal database systems such as Indian Kanoon and SCC Online operationalize name-based de-indexing while keeping their vast archives usable for lawyers? More significantly, what kind of legal force will global directions for de-indexing hold over those search engines whose main servers lie outside of Indian territory?
This is not to say the judgment isn't important. It simply presents a predictable, almost mundane set of issues that all ambitious pronouncements on constitutional rights face when translated into the world of administration issues that came up even when the EU was first struggling with enforcing the GDPR in 2018. India now has its framework, and the details of its implementation will undoubtedly come through future rounds of litigation, guidelines, and perhaps even legislation.
What remains abundantly clear, though, is the message conveyed by the Delhi High Court that digital permanency is a crime, especially when it causes the most incriminating of a person's legal actions to follow them perpetually, even long after they have been given due process by the system. As Justice Datta eloquently put it, privacy in the digital age is 'not about secrecy but about an individual's control over the dissemination of personal information.' "Now an element of constitutional law in India, the verdict is a declaration that will resonate long beyond the thirty-odd petitions that called it into being.
Conclusion
The ultimate finding of the 2026 right-to-be-forgotten judgment in Delhi High Court reinforces human dignity in the digital era. The Court has acknowledged the need for acquittals and exonerations to have meaningful implications offline, ensuring an individual is not eternally punished through online searches for alleged wrongdoing. Building on the right to privacy established by K.S. Puttaswamy v. Union of India, informational privacy now stands at the core of constitutional guarantees, and India joins the nations establishing precedents to balance openness with dignity.
Related Blogs
Executive Summary
A postcard carrying the logo of Navbharat Times and featuring Prime Minister Narendra Modi is being widely shared on social media. The postcard quotes Modi as allegedly saying, “The gold of this country will be used for the people of this country. Gold is being sold to save the economy. If this is not done, the country's industrialists will be ruined and people will suffer from unemployment.”Based on this postcard, users are claiming that Prime Minister Modi justified the sale of the country's gold reserves by saying it was necessary to protect the economy and prevent industrialists from facing losses. However, CyberPeace Research Wing research found that Prime Minister Modi never made such a statement. The viral Navbharat Times postcard has been digitally edited.
Claim
An X user with the handle “Brainwash” shared the postcard and wrote: “Sir, have you kept the PM CARES Fund for your own household? Take back the money distributed to industrialists. People should not fall for these claims. Everything they say is false and mere rhetoric.”
https://x.com/Bhawanipm/status/2062259463084785666
Fact Check
To verify the claim, we conducted keyword searches related to the purported statement. However, we found no credible reports, speeches, interviews, or official records in which Prime Minister Modi made such remarks about selling the country's gold reserves. We then examined the viral postcard and searched the social media handles of Navbharat Times for the original post. During this process, we found a similar postcard published on the Facebook page of Navbharat Times Uttar Pradesh on May 16, 2026. The design, layout, and image matched the viral postcard. However, the original post carried a completely different quote attributed to Prime Minister Modi.
The original postcard quoted Modi as saying: “This decade is becoming a decade of disasters for the world.”
https://www.facebook.com/photo/?fbid=1505172121619709&set=a.685493923587537
Conclusion
Prime Minister Narendra Modi has not made any statement claiming that the country's gold is being sold to save the economy or to protect industrialists from losses. The viral Navbharat Times postcard has been digitally edited, and the quote attributed to Modi is fabricated.
.webp)
Introduction
The Digital Personal Data Protection (DPDP) Act, of 2023, introduces a framework for the protection of personal data in India. Data fiduciaries are the entity that essentially determines the purpose and means of processing of personal data. The small-scale industries also fall within the ambit of the term. Startups/Small companies and Micro, Small, and Medium Enterprises (MSMEs) while determining the purpose of processing of personal data in the capacity of ‘data fiduciary’ are also required to comply with the DPDP Act provisions. The obligations set for the data fiduciary will apply to them unilaterally, though compliance with this Act and can be challenging due to resource constraints and limited expertise in data protection.
DPDP Act, 2023 Section 17(3) gives power to the Central Government to exempt Startups from being obligated to comply with the Act, taking into account the volume and nature of personal data processed. It is the nation's first standalone law on data protection and privacy, which sets forth strict rules on how data fiduciaries can collect and process personal data, focusing on consent-based mechanisms and personal data protection. Small-scale industries are given more time to comply with the DPDP Act. The detailed provisions to be notified in further rulemaking called ‘DPDP rules’.
Obligations on Data Fiduciary under the DPDP Act, 2023
The DPDP Act focuses on processing digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto. Hence, small-scale industries also need to comply with provisions aimed at protecting digital personal data.
The key requirements to be considered:
- Data Processing Principles: Ensuring that data processing is done lawfully, fairly, and transparently. Further, the collection and processing of personal data is only for specific, clear, and legitimate purposes and only the data necessary for the stated purpose. Ensuring that the data is accurate and up to date is also necessary. An important part is that the data is not retained longer than necessary and appropriate security measures are taken to protect the said data.
- Consent Management: Clear and informed consent should be obtained from individuals before collecting their personal data. Further, individuals have the option to withdraw their consent easily.
- Rights of Data Principals: Data principals (individuals) whose data is being collected have the right to Information, the right to correction and erasure of data, the right to grievance redressa, Right to nominate.the right to access, correct, and delete their personal data. Data fiduciaries need to be mindful of mechanisms to handle requests from data principals regarding their concerns.
- Data Breach Notifications: Data fiduciaries are required to notify the data protection board and the affected individuals in case a data breach has occurred.
- Appropriate technical and organisational measures: A Data Fiduciary shall implement appropriate technical and organisational measures to ensure effective observance of the provisions of this Act and the rules made thereunder.Cross-border Data Transfers: Compliance with regulations in relation to the transfer of personal data outside of India should be ensured.
Challenges for Small Scale Industries for the DPDP Act Compliance
While small-scale industries have high aims for their organisational growth and now in the digital age they also need to place reliance on online security measures and handling of personal data, with the DPDP act in the picture it becomes an obligation to consider and comply with. As small-scale industries including MSMEs, they might face certain challenges in fulfilling these obligations but digital data protection measures will also boost the competitive market and customer growth in their business. Bringing reforms in methods aimed at better data governance in today's digital era is significant.
One of the major challenges for small-scale industries could be ensuring a skilled workforce that understands and educates internal stakeholders about the DPDP Act compliances. This could undoubtedly become an additional burden.
Further, the limited resources can make the implementation of data protection, which is oftentimes complex for a layperson in the case of a small-scale industry, difficult to implement. Limitations in resources are often financial or human resources.
Cybersecurity, cyber awareness, and protection from cyber threats need some form of expertise, which is lacking in small enterprises. The outsourcing of such expertise is a decision that is sometimes taken too late, and some form of harm can take place between the periods by which an incident can occur.
Investment in the core business or enterprise many times doesn't include technology other than the basic requirements to run the business, nor towards ensuring that the data is secure and all compliances are met. However, in the fast-moving digital world, all industries need to be mindful of their efforts to protect personal data and proper data governance.
Recommendations
To ensure the proper and effective personal data handling practices as per the provisions of the act, the small companies/startups need to work backend and frontend and ensure that they take adequate measures to comply with the act. While such industries have been given more time to ensure compliance, there are some suggestions for them to be compliant with the new law.
Small companies can ensure compliance with the DPDP Act by implementing robust data protection policies, investing in and providing employee training on data privacy, using age-verification mechanisms, and adopting privacy-by-design principles. Conduct a gap analysis to identify areas where current practices fall short of DPDP Act requirements. Regular audits, secure data storage solutions, and transparent communication with users about data practices are also essential. Use cost-effective tools and technologies for data protection and management.
Conclusion
Small-scale industries must take proactive steps to align with the DPDP Act, 2023 provisions. By understanding the requirements, leveraging external expertise, and adopting best practices, small-scale industries can ensure compliance and protect personal data effectively. In the long run, complying with the new law would lead to greater trust and better business for the enterprises, resulting in a larger revenue share for them.
References
- https://pib.gov.in/PressReleaseIframePage.aspx?PRID=1959161
- https://www.financialexpress.com/business/digital-transformation-dpdp-act-managing-data-protection-compliance-in-businesses-3305293/
- https://economictimes.indiatimes.com/tech/technology/big-tech-coalition-seeks-12-18-month-extension-to-comply-with-indias-dpdp-act/articleshow/104726843.cms?from=mdr
Executive Summary
A photograph showing Union Education Minister Dharmendra Pradhan standing with a woman is being widely circulated on social media. Users are falsely claiming that the woman in the image is Manisha Mandhare, a teacher allegedly arrested in the NEET-UG paper leak case. CyberPeace Research Wing research confirms that the woman in the viral photograph is Dr. Nivedita Ekbote and not Manisha Mandhare. Social media users are falsely misidentifying her and linking her to the NEET paper leak case without evidence.
Claim
Several social media users, including Facebook and Instagram pages, have shared the image claiming that the woman seen with the Union Minister is Manisha Mandhare, who was arrested in connection with the NEET paper leak case.
- https://www.facebook.com/Sri.Media.Kannada/posts/pfbid0pCuJrhcz3mcf8MzYci4oWXaTKvaJYNjCtGo34Z6R9ztshWqs3QUupyHNu2K4Rodpl?rdid=WtnRhDM22ftHT9oe
- https://archive.is/uwmsj
Fact Check
A reverse image search of the viral photograph reveals that the woman is actually Dr. Nivedita Ekbote, Principal of Modern College and Vice President of the Bharatiya Janata Yuva Morcha in Maharashtra. Nivedita Ekbote originally shared this photograph on December 18, 2024, across her official social media accounts on X (formerly Twitter), Facebook, and Instagram. According to the caption, the image was taken during the Pune Book Festival, where she met the Union Education Minister along with her parents.
In a public clarification, she stated that her photograph was being misused online. She added that the image was taken at a public event with several dignitaries and strongly condemned the circulation of false and misleading claims using it.
- https://x.com/EkboteNivedita/status/2056265520765399049?s=20
Further verification from credible news reports confirms that Manisha Mandhare, who is linked to the NEET paper leak case, is a senior botany teacher from Pune. She was reportedly appointed as a subject expert by the National Testing Agency (NTA) for NEET-related processes. Her identity is completely different from the woman seen in the viral image.
Conclusion
The viral claim is completely false and misleading. The woman seen with Union Education Minister Dharmendra Pradhan is Dr. Nivedita Ekbote, and she has no connection to the NEET-UG paper leak case.
