What a deletion certificate from a vendor should explain

A vendor sends a one-line certificate: “All customer data has been deleted.” The statement looks decisive, but the business still needs to know what “all” means. Did it include support attachments, exports, subprocessors and recovery copies? Were some records retained for a stated reason? Who verified the result?

A deletion certificate is useful only when its scope and evidence are clear. It should support the business’s decision, not replace the work of identifying the relevant data and obligations.

As of 22 October 2026, the main DPDP duties are scheduled for 13 May 2027 under the commencement notification. The Act and Rules do not prescribe one universal certificate template for every supplier deletion. The questions below are a recommended contracting and assurance practice.

Connect the certificate to an instruction

Identify the contract, service, customer account and deletion instruction. State whether the action concerns one individual’s request, a dataset, a terminated service or an entire business account. Without that reference, the certificate may describe a narrower action than the buyer intended.

The future section 8(7) duty includes causing processors to erase relevant personal data when the erasure obligation applies, subject to lawful retention. Section 8(1) retains fiduciary accountability for processing on its behalf. A vendor statement helps evidence the response but does not automatically settle those obligations.

A hypothetical payroll client terminating a service should therefore specify whether historical employee records, uploaded spreadsheets, support tickets and test imports are within scope. “Delete our tenant” may be an ambiguous technical instruction if those items sit outside the tenant database.

Describe the systems and actions

Ask the supplier to identify the relevant systems or categories of systems and the action taken in each. Erasing records, disabling access, anonymising data and hiding a profile from an interface are different outcomes. The certificate should use the term that matches the operation.

Where anonymisation is claimed, ask how the supplier has assessed whether information remains linked or linkable to an individual. Merely removing a name does not establish that every remaining record falls outside the personal-data definition in section 2(t). Avoid accepting a label without enough explanation to evaluate it.

Record the completion date and the responsible supplier function. Where the operation ran in stages, identify the dates and any remaining stage. A submitted deletion job is not necessarily a completed deletion job.

Make exceptions explicit

The final Rule 8(3) contains a minimum one-year retention period from processing for personal data, associated traffic data and processing logs for the Seventh Schedule purposes, followed by erasure unless further lawful retention applies. Rule 6 contains a separate security-related provision. Other applicable law may also affect particular records.

A certificate should therefore identify retained categories, the reason, access restrictions and the planned review or disposal event. “Retained as legally required” is too broad if the supplier cannot identify the category and relevant requirement.

The business should assess whether the supplier’s explanation fits its own role and instructions. A vendor should not silently use a narrow legal retention need to continue unrelated analytics or marketing activity.

Address downstream suppliers and backups

Ask which relevant subprocessors received the information and how their deletion or retention outcomes were handled. A primary vendor’s live database may be empty while an outside support provider still holds attachments.

Backups need an accurate account of the actual architecture, retention and restoration controls. Do not demand an impossible statement merely to make the certificate look stronger. Equally, do not accept a blanket assertion that backups are outside every obligation without examining the legal and operational position.

If historical recovery copies remain under a justified arrangement, record how access is restricted and how restored data will be reconciled with the deletion decision. The customer-facing explanation should reflect that outcome.

Decide how much assurance is proportionate

For a small, low-complexity service, a clear signed statement supported by the contract and action record may provide useful assurance. A consequential or complex arrangement may justify additional logs, a technical demonstration, independent assurance or a targeted audit right. These are risk-based commercial choices, not universal statutory certificate requirements.

Review contradictions. If a supplier says all records are erased but also says it can restore the full account on request, ask what remains and on what terms. Resolve the discrepancy before marking the task complete.

Keep the instruction, certificate, exceptions and follow-up evidence together. The strongest certificate is specific enough that another reviewer can understand what happened, what remains and why the business accepted the outcome.