Field notes: how Tofler responded to our first Section 12 batch.

A field note from the early days of operating against Tofler.

The first batch.

We sent eighty Section 12 notices to Tofler on a single day in February 2026. The notices were for our founder-tier users whose residential addresses were appearing on Tofler's director-data pages. Each notice followed our standard template at the time.

The response.

Within seventy-two hours we received a single email from Tofler's legal counsel that read, paraphrased: "We have received eighty erasure notices from Vault.in. The data on our platform is sourced from public MCA filings under the Companies Act, 2013. We do not consider this data to be subject to Section 12 erasure under the DPDP Act. Please advise."

The legal argument is not trivial. MCA filings are public by statute. The DPDP Act carries narrow exemptions for processing of data in compliance with law. Tofler's position was that they were a mirror of public data, and that erasure on their platform would not erase the underlying data, so the right was inapposite.

Our reply.

We replied with three points.

First, the Companies Act requires the MCA to maintain the records, not third parties to mirror them. The statutory obligation rests with the MCA. Tofler's processing of the data is a derivative commercial use, which is subject to DPDP consent requirements like any other commercial use.

Second, even if the underlying data is public, the aggregation, indexing, and search-engine-optimisation of that data create new processing activities that require their own legal basis. The Telangana High Court's 2021 ruling in the Sridhar case is on point (we cited paragraph 47).

Third, the right to erasure under Section 12 attaches to the data held by the specific Fiduciary, not to the underlying source. Erasure at Tofler does not require erasure at MCA. The two are separate Fiduciary relationships under the Act.

The settlement.

Tofler agreed to remove residential addresses (which they had been displaying alongside the MCA-sourced data without specific basis) within forty-five days. They declined to remove the director-name and company-association data, citing the MCA-public argument; we accepted this for now. We will likely take this to the Board within the next year to get a definitive Indian ruling on the derivative-commercial-use point.

What we changed.

We refined our template for director-data aggregators specifically. The new template enumerates the specific data classes (residential address, personal email, personal phone) and demands erasure of those classes, while explicitly conceding the MCA-public argument on company-name and director-name. The success rate on these requests is now 70%, up from a hypothetical zero under the original template (which would have been refused wholesale on the MCA argument).

This is the work. The template is not a static document; it is a continuously refined product of working through real refusals. Each refusal sharpens the next version. The system is designed for this.