Single judge bench of Orissa High Court, in this bail matter, held that right to be forgotten (or left alone) is part of bouquet of rights enshrined in Article 21 of the Constitution.

From Para 5,

5. While examining the pages of the case records, prima facie, it appears that the petitioner has uploaded the said photos/videos on a social media platform i.e. Facebook and with the intervention of the police, after some days, he deleted the said objectionable contents from the Facebook. In fact, the information in the public domain is like toothpaste, once it is out of the tube one can’t get it back in and once the information is in the public domain it will never go away. Under the Indian Criminal Justice system a strong penal action is prescribed against the accused for such heinous crime but there is no mechanism available with respect to the right of the victim to get the objectionable photographs deleted from the server of the Facebook. The different types of harassment, threats and assaults that frighten citizens in regard to their online presence pose serious concerns for
citizens. There is an unprecedented escalation of such insensitive behavior on the social media platforms and the victim like the present one could not get those photos deleted permanently from server of such social media platforms like facebook. Though the statute prescribes penal action for the
accused for such crimes, the rights of the victim, especially, her right to privacy which is intricately linked to her right to get deleted in so far as those objectionable photos have been left unresolved. There is a widespread and seemingly consensual convergence towards an adoption and enshrinement of the right to get deleted or forgotten but hardly any effort has been undertaken in India till recently, towards adoption of such a right, despite such an issue has inexorably posed in the technology dominated world. Presently, there is no statute in India which provides for the right to be forgotten/getting the photos erased from the server of the social media platforms permanently. The legal possibilities of being forgotten on line or off line cries for a widespread debate. It is also an undeniable fact that the implementation of right to be forgotten is a thorny issue in terms of practicality and technological nuances. In fact, it cries for a clear cut demarcation of institutional boundaries and redressal of many delicate issues which hitherto remain unaddressed in Indian jurisdiction. The dynamics of hyper connectivity- the abundance, pervasiveness and accessibility of communication network have redefined the memory and the prescriptive mandate to include in the technological contours is of pressing importance.

From Para 14,

14. Section 27 of the draft Personal Data Protection Bill, 2018 contains the right to be forgotten. Under Section 27, a data principal (an individual) has the right to prevent continuing disclosure of personal data by a data fiduciary. The aforesaid provision which falls under Chapter VI (Data Principal Rights) of the Bill, distinctly carves out the “right to be forgotten” in no uncertain terms. In terms of this provision, every data principal shall have the right to restrict or prevent continuing disclosure of personal data (relating to such data principal) by any data fiduciary if such disclosure meets any one of the following three conditions, namely if the disclosure of personal data:
(i) has served the purpose for which it was made or is no longer necessary; or
(ii) was made on the basis of the data  principal’s consent and such consent has since been withdrawn; or
(iii) was made contrary to the provisions of the bill or any other law in force.
In addition to this, Section 10 of the Bill provides that a data fiduciary shall retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is  processed. Further, it imposes an obligation on every data fiduciary to undertake periodic reviews in order to  determine whether it is necessary to retain the personal data in its possession. If it is not necessary for personal data to be retained by a data fiduciary, then such personal data must be deleted in a manner as may be specified.

Index of Article 21 case laws is here.