Right to Be Forgotten in India: What the Law Says in 2026

The Legal Basis for Right to Be Forgotten in India in 2026

Unlike the European Union, which enacted a comprehensive RTBF regime under Article 17 of the General Data Protection Regulation (GDPR) in 2018, India's approach has been incremental and court-driven. There is no single statutory provision that says “you have the right to be forgotten” in the same explicit terms as the GDPR. Instead, Indian courts have carved out the right through constitutional interpretation, applying the Puttaswamy framework to specific facts — most often involving outdated judicial records, old news articles, and historical personal information that continues to appear prominently in search results.

The IT Act 2000 and the IT Rules 2021 provide additional procedural tools. While neither expressly creates an RTBF right, the IT Rules 2021 do impose obligations on platforms to act on complaints from users, and courts have used the non-compliance with these obligations as a ground for granting mandatory orders in RTBF-adjacent cases. The result is a layered legal landscape where the constitutional right provides the foundation, the DPDP Act provides statutory reinforcement, and the IT Rules provide the procedural mechanism.

In 2026, the most significant practical development is the anticipated constitution of the Data Protection Board of India under the DPDP Act 2023. Once operational, the Board will provide a formal administrative route for Section 13 erasure requests that does not require High Court proceedings. Until that point — and the Board has not been constituted as of early 2026 — the court-based route under Article 21 of the Constitution remains the primary and most effective mechanism for enforcing RTBF claims in India.

The Constitutional Foundation: Puttaswamy

The Supreme Court's landmark judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) recognised the right to privacy as a fundamental right under Article 21 of the Constitution. The nine-judge bench unanimously held that privacy is intrinsic to life and personal liberty and therefore protected at the constitutional level. The judgment specifically contemplated the “right to be forgotten” — the ability of individuals to seek removal of personal information that is outdated, irrelevant, or no longer necessary to retain in the public domain.

While Puttaswamy did not directly order any specific content removal, it established the constitutional underpinning for the Right to Be Forgotten in India. Subsequent High Court judgments have applied this principle in specific factual contexts, building a body of case law that now provides reasonably clear guidance on when RTBF claims will succeed and when they will not.

The judgment identified several dimensions of the right to privacy that are directly relevant to RTBF claims: the right to control personal information, the right to informational self-determination, and the right not to be defined by past events that no longer reflect one's current situation. All three dimensions find application in the most common RTBF scenarios — acquittals overshadowed by old arrest reports, youthful indiscretions still prominent in search results, and old professional disputes that continue to colour current reputation.

The Puttaswamy test for any restriction on the right to privacy — including the continuation of personal information in the public domain — requires that the restriction be: (1) sanctioned by law; (2) pursuing a legitimate aim; (3) proportionate to the aim; and (4) subject to procedural guarantees. Courts applying this test to RTBF petitions examine whether the continued online presence of the information serves a proportionate legitimate aim. Where it does not — because the matter is resolved, the information is outdated, or the subject is a private individual — the test favours removal.

High Court Cases Upholding Right to Be Forgotten in India

The Karnataka High Court in Sri Vasunathan v. The Registrar General (2017) allowed an individual to seek removal of his daughter's name from a court judgment published online, reasoning that the information no longer served any public interest. The petitioner's daughter had been involved in a matrimonial dispute that was resolved, but her name continued to appear in search results associated with the court record. The Karnataka HC ordered the removal of her name from the online version of the judgment, applying right-to-privacy principles in what is widely regarded as India's first significant RTBF ruling.

The Jorawer Singh Mundy case before the Delhi High Court in 2021 is the most widely cited Indian RTBF judgment. The petitioner, a dual national, had been acquitted in a criminal case involving narcotics charges, but the judgment continued to appear as the first search result when his name was queried on Google. The Delhi HC ordered de-indexing of the judgment from Google's search results, holding that an acquitted person has a legitimate interest in not being permanently associated with charges of which he was cleared. The court balanced this against the principle of open justice and held that while the judgment would remain on the court's official website, its continued prominent appearance in general internet searches served no proportionate legitimate purpose.

These cases have established a working judicial doctrine: where content relating to an individual serves no legitimate ongoing public interest and causes ongoing harm through its continued online prominence, courts can order its removal or de-indexing under the right to privacy. This is most effective where the underlying matter has concluded — acquittal, settlement, time-passage — and the content is therefore misleading in its current form, creating a false impression about the individual's current circumstances.

Other relevant High Court rulings include decisions from the Bombay High Court and the Madras High Court in cases involving outdated personal information in judicial records and old news articles. The consistent thread across these rulings is the proportionality analysis: courts ask whether the continued public accessibility of the information serves a purpose that justifies the ongoing harm to the individual's privacy and reputation. Where the purpose is merely archival — preserving historical records with no current public interest value — courts have leaned toward ordering removal or de-indexing.

Who Qualifies for Right to Be Forgotten?

RTBF claims are most consistently upheld in three categories of cases. The first is individuals who were accused of criminal offences but were subsequently acquitted, had charges dropped, or had cases discharged — and whose names remain prominently associated with the accusations in search results. The rationale is clear: an acquitted person is legally innocent, and the continued online association with criminal charges perpetuates an unjust stigma that the legal system itself has rejected.

The second category is private individuals whose personal information appeared in old news articles, court filings, or other public records that served a legitimate purpose at the time but no longer carry any ongoing public interest. A person involved in a civil property dispute in 2010 who is still appearing in search results for their name in 2026, associated with that resolved dispute, has a legitimate RTBF claim. Courts distinguish between information about resolved private matters and information about ongoing public concerns.

The third category is individuals whose outdated professional or personal information — old negative reviews, old disputes, old regulatory actions subsequently reversed — continues to mislead current searchers about their present circumstances. This category is more contested, because courts are wary of allowing RTBF to be used to suppress legitimately public information about professional conduct. The key factors are: how long ago the events occurred, whether the matter was resolved in the individual's favour, and whether continuing to display the information serves any proportionate public purpose.

RTBF arguments are significantly weaker — and often fail entirely — where the individual is a public figure, politician, senior corporate officer, or holder of public trust on a matter of ongoing public concern. Courts apply a reduced expectation of privacy to such individuals in relation to their exercise of public functions. A sitting Member of Parliament cannot invoke RTBF to remove accurate reporting about their voting record. A former CEO cannot use RTBF to remove accurate coverage of a corporate fraud in which they were found culpable. The public interest in accountability outweighs the individual's privacy interest in these scenarios.

How to File a Right to Be Forgotten Petition at High Court

Filing a RTBF petition before the competent High Court begins with a careful assessment of the facts against the existing judicial doctrine. Not all RTBF claims are equally strong, and an unsuccessful petition that is dismissed on merits creates an adverse precedent that complicates future applications. RepuLex recommends an initial legal assessment under NDA before any petition is filed, to evaluate the strength of the claim and identify the most appropriate jurisdiction and legal grounds.

The petition is typically filed as a writ petition under Article 226 of the Constitution, invoking the fundamental right to privacy under Article 21 as interpreted in Puttaswamy. The petitioner must: (1) identify the specific URLs to be de-indexed or content to be removed; (2) establish their identity and connection to the content; (3) demonstrate that the content is outdated, no longer serves a legitimate public purpose, and causes ongoing harm; and (4) name the correct respondents — typically the platform hosting the content, Google India, and if the original publisher is identifiable, the publisher.

The petition must address the proportionality analysis that courts apply: why does the continued online presence of this specific content not serve a legitimate purpose proportionate to the harm caused? This requires careful pleading backed by evidence of actual harm — professional setbacks, personal distress, measurable consequences traceable to the content's continued prominence in search results. Courts are not sympathetic to petitions that are speculative about harm or that seek removal of content for convenience rather than compelling necessity.

Once filed, the petition is listed for hearing before the appropriate bench. In Delhi HC, cases involving online reputation and digital privacy have been assigned to specific judges with expertise in technology law matters, which has improved the quality and consistency of orders. An application for interim relief — a temporary injunction directing de-indexing pending final hearing — can be filed simultaneously and may be heard on an urgent basis where the petitioner demonstrates irreparable harm in the interim period. If the matter is urgent, urgent mention before the bench can compress the listing timeline significantly.

Right to Be Forgotten vs Defamation Removal: Which Route Should You Take?

Right to Be Forgotten and defamation removal are distinct legal remedies that are frequently conflated but apply in different circumstances and are pursued through different legal mechanisms. Choosing the correct route depends on the nature of the content and the relationship between the content and truth. Choosing the wrong route wastes time, resources, and in some cases creates adverse legal precedent.

Defamation removal applies where the content contains false statements of fact that harm reputation. The key element is falsity — the content is unlawful precisely because it is untrue. If a news article states falsely that you were convicted of fraud when you were actually acquitted, the correct route is defamation proceedings — the article is unlawful, not merely inconvenient. Defamation proceedings can proceed faster than RTBF petitions in many courts, particularly where the falsity is straightforward and the harm is significant, because courts are well-practised in granting interim injunctions in defamation cases.

RTBF applies where the content may be factually accurate but is outdated, no longer relevant, and causes disproportionate ongoing harm. The key element is proportionality — the content is not necessarily unlawful in itself, but its continued prominent display is no longer justified. If a news article accurately reported that you were under investigation in 2015 but you were cleared in 2016 and the article about the investigation (not the clearance) continues to appear in searches in 2026, the appropriate remedy is RTBF — the article was true when published but its continued prominence is now misleading and harmful.

The two remedies are not mutually exclusive and are often pursued simultaneously. If content is both false and outdated, both grounds apply and advancing both strengthens the legal position. RepuLex structures pleadings to advance all applicable grounds in parallel — defamation, RTBF, and where relevant, IT Act Section 79 — rather than selecting one and abandoning the others. In complex cases involving news articles about resolved criminal matters, the combination of defamation (if the article contains false claims) and RTBF (for the overall misleading impact of the continued prominence) produces the most comprehensive and durable result.

Google's Response to Right to Be Forgotten Requests in India

Google's global policy on RTBF is shaped primarily by its obligations under European law, where a structured RTBF regime under the GDPR requires Google to maintain a formal evaluation process for erasure requests. In India, where no comparable statutory regime was in force as of early 2026, Google has not maintained an equivalent voluntary RTBF process and has generally required a court order before de-indexing content in response to Indian RTBF claims.

Google India has, however, complied with High Court orders in well-documented RTBF cases, including the Jorawer Singh Mundy case and subsequent Delhi HC orders in similar matters. Compliance with court orders in India is not discretionary for Google — it creates an obligation under the contempt jurisdiction of the High Courts. Google's legal team in India processes court orders through a dedicated legal channel, separate from its general content removal workflows, and compliance has generally been achieved within 48-72 hours of formal service of the order.

Voluntary RTBF compliance by Google without a court order in India remains rare and is not reliably achievable through ordinary user requests or standard legal notices. The structured RTBF evaluation process that Google operates for European users has not been extended to Indian users as a general matter. However, in cases where an Indian court order is produced, Google's compliance has been consistent. The path to RTBF enforcement against Google in India, therefore, runs through the courts rather than through Google's voluntary mechanisms.

The position may evolve once the Data Protection Board of India is constituted and begins adjudicating Section 13 erasure requests under the DPDP Act. If the Board issues directions to data fiduciaries — including Indian operations of global companies — to erase data pursuant to valid erasure requests, this will create a compliance obligation for Google India that does not currently exist outside of court orders. Whether Google's Indian operations will be treated as “data fiduciaries” for all data processed about Indian users, including search index data, is a question that will be clarified as the Board begins its work.

The Digital Personal Data Protection Act 2023

The Digital Personal Data Protection (DPDP) Act, 2023, enacted in India, provides for the right to erasure of personal data under Section 13. A data principal — the individual whose data is being processed — has the right to withdraw consent and seek erasure of their personal data. The data fiduciary — the entity processing the data — is required to cease further processing and erase the data upon receipt of a valid erasure request, subject to certain exceptions including legal proceedings, compliance obligations, and legitimate business purposes.

While the Act's provisions are yet to be fully operationalised through the Data Protection Board of India, it provides a statutory basis for erasure requests that supplements the constitutional right established in Puttaswamy. The Act creates a statutory mechanism that will, once the Board is constituted, allow individuals to file formal complaints against data fiduciaries who retain or publish personal data without valid grounds. The Board will have the power to impose significant financial penalties for non-compliance — up to 250 crore rupees for certain categories of violation.

The DPDP Act also introduces the concept of "deemed consent" and "legitimate uses" which define the outer limits of what a data fiduciary can retain and process without explicit consent. News publishers, research organisations, and archival services are likely to be designated as categories that can retain data beyond a withdrawal of consent — but the scope of these exceptions will be determined through rules and Board adjudication over time. The interplay between press freedom and the right to erasure under the DPDP Act is an area of ongoing legal development that will directly affect RTBF claims against news portals.

For individuals seeking to exercise RTBF-equivalent rights under the DPDP Act in 2026, the practical advice is to pursue the constitutional route through High Courts simultaneously with a formal erasure notice under the DPDP Act framework. The court route provides immediate enforceable relief; the DPDP Act notice creates a statutory record that reinforces the legal position and may become the primary route once the Board is operational. RepuLex structures its RTBF engagements to advance both tracks from the outset.

PDPB 2023 and the Future of RTBF in India

The Digital Personal Data Protection Act 2023 (popularly referred to by its earlier draft name PDPB, or as DPDP Act) represents India's most significant legislative development in the RTBF space since the Puttaswamy judgment. Its full implementation will fundamentally change the landscape for individuals seeking to erase online content — providing a structured administrative route that currently does not exist. Understanding the trajectory of the Act is therefore essential to planning a comprehensive RTBF strategy in 2026.

Once the Data Protection Board is constituted — its constitution is awaited as of early 2026 — India will have a formal adjudicatory body specifically designed to handle data erasure complaints. The Board will be empowered to receive complaints from data principals, summon data fiduciaries, hear arguments, and issue binding directions for erasure or correction. This parallels the structure of the European Data Protection Boards established under the GDPR and represents a similar institutional framework adapted to the Indian context.

The scope of the DPDP Act's RTBF-equivalent provisions extends beyond what courts have ordered under constitutional grounds. While courts applying Puttaswamy have generally focused on cases with clear and compelling public interest analysis — acquittals, outdated records, significant ongoing harm — the DPDP Act Section 13 does not require the same level of harm-demonstration for a withdrawal of consent to be valid. If the data was originally processed with the data principal's consent, and that consent is withdrawn, erasure follows unless a specific exception applies. This lowers the threshold for certain categories of RTBF claim significantly.

The most contested area will be the exception for “journalistic purposes” and “research and archival purposes.” Indian news portals will likely argue that they fall within these exceptions and are therefore not required to erase personal data on request. The Board's rulings on this issue will determine whether DPDP Act Section 13 becomes a practical tool against news portals — which is the largest single category of RTBF requests RepuLex receives — or remains limited to non-journalistic data processors. The resolution of this question will shape the RTBF landscape for the remainder of the decade.

Practical Timeline: How Long Does RTBF Take in India?

The realistic timeline for achieving RTBF in India in 2026 depends on the route taken, the cooperation of the platform, and whether court proceedings are required. For the most straightforward cases — a single URL, an Indian-registered platform, and a clear RTBF basis — a legal notice under the DPDP Act framework and the Puttaswamy constitutional right, addressed to the platform's Grievance Officer, can achieve removal in 15-30 days if the platform is compliant. This is the best-case scenario.

Where the platform does not comply with the legal notice, a writ petition before the competent High Court is required. From the date of filing to first hearing typically takes 2-8 weeks depending on the court, the judge, and the listing schedule. If the petitioner obtains an urgent mention and demonstrates irreparable harm, the hearing may be accelerated. Courts in Delhi HC have heard urgent RTBF-adjacent matters within days of filing where sufficient urgency was demonstrated. An interim de-indexing order, if granted, takes effect within 48-72 hours of service on the platform.

For cases involving foreign-headquartered platforms — particularly Google and Meta — adding international service requirements extends the process. However, where Google India is named as a respondent in its own right (rather than Google LLC), service within India is sufficient and timelines are materially shorter. Delhi HC has treated Google India as a proper respondent for matters arising from content accessible in India, avoiding the need for foreign service in most cases.

Realistically, most RTBF cases at RepuLex that proceed through the full cycle — notice, non-compliance, filing, interim order, and final compliance — resolve between 45 and 120 days from initial engagement. Cases where the platform cooperates with the legal notice resolve in 15-30 days. Cases involving multiple URLs across multiple platforms at different stages of compliance take longer, as each platform and each URL requires individual attention. RepuLex provides clients with a realistic timeline assessment at the start of each engagement, based on the specific facts and platforms involved.

How to Use RTBF in Practice: Steps to Take in 2026

Step one — Assess whether RTBF applies: RTBF is most applicable where the content is factually accurate but outdated, no longer serves public interest, and continues to cause measurable harm. If the content is false, defamation proceedings are more appropriate and more powerful. The two grounds are not mutually exclusive — RepuLex often pursues both simultaneously. An initial legal assessment under NDA, typically provided within 24-48 hours of engagement, will identify the applicable grounds and the strongest route.

Step two — Document the harm: Indian courts require evidence of ongoing harm to balance against public interest in the information. Bank rejections, professional credentialling denials, client losses, or appointment setbacks traced to the content are all relevant. Screenshot evidence of the content appearing prominently in search results for your name is essential. The more specific and quantifiable the harm, the stronger the petition. Abstract statements about distress or reputational concern, without supporting evidence, are insufficient to sustain a RTBF petition.

Step three — Send a formal erasure or removal notice: Under the DPDP Act framework and the constitutional right to privacy, a formal notice to the platform or publisher demanding removal of the specific personal data — citing Section 13 DPDP Act and the Puttaswamy judgment — is the first legal step. This establishes the record and, in many cases, triggers voluntary compliance, particularly from Indian-registered platforms. The notice should be sent through a practising advocate on letterhead, to the Grievance Officer, with proof of delivery.

Step four — File a writ petition if the notice is ignored: Where the platform is foreign-headquartered or refuses to comply, a writ petition before the competent High Court invoking Article 21 and seeking a mandatory order for removal and de-indexing is the appropriate escalation. Delhi HC, Karnataka HC, and Bombay HC have all entertained such petitions and passed orders in appropriate cases. The petition should invoke both constitutional grounds and, where applicable, DPDP Act Section 13 as reinforcing statutory authority — even ahead of the Data Protection Board's constitution, courts have treated the enacted statutory right as relevant to the constitutional analysis.

DPDP Act 2023: Implementation Status in 2026

As of early 2026, the Digital Personal Data Protection Act 2023 has been enacted but the Data Protection Board of India — the statutory body responsible for adjudicating erasure requests under Section 13 — has not yet been constituted. The rules under the Act are in draft stage and are expected to be finalised in 2026. This means that while the right to erasure exists in statute, the formal administrative mechanism for exercising it through the Board is not yet operational.

In practice, this gap is bridged through High Court proceedings. Individuals seeking removal of personal data on RTBF grounds continue to file writ petitions invoking Article 21 (right to privacy, Puttaswamy) and increasingly cite the DPDP Act Section 13 as reinforcing the constitutional right — even ahead of the Board's constitution. Indian courts have generally been receptive to this combined constitutional-statutory argument, particularly where the data is outdated, the subject is a private individual, and the continued publication serves no legitimate public interest.

Once the Data Protection Board is constituted and operational — expected in 2026 — individuals will have an additional administrative route for DPDP Section 13 erasure requests, separate from and parallel to the court-based RTBF route. This will lower the cost and complexity of certain erasure requests, particularly for data held by Indian companies. RepuLex monitors the Board's constitution and will advise clients on when and how to use the statutory route as it becomes available.

The DPDP Act also brings significant changes for data fiduciaries — companies and platforms that process personal data of Indian users. They will be required to establish clear retention policies and respond to erasure requests within defined timelines. Non-compliance will attract significant financial penalties. The combined effect of Board supervision and penalty exposure is expected to make Indian platforms substantially more responsive to erasure requests than they currently are — potentially rendering the court-based route unnecessary for a large proportion of RTBF cases once the Board is operational and has established its compliance expectations through its first wave of adjudications.