The DPDP Act mandates businesses to erase personal data after a specific period of time. However, there is no fixed time rule for data retention. To understand when and how long the business can retain data. It is required to know the act section and rules properly. Here in this blog, the business gets information about the data retention policies and the timeline. It will help you follow the guidelines and stay compliant with data privacy regulations.
What Is a Data Retention Policy?
A data retention policy is a formal document containing guidelines on how a business handles data.’ This policy is different for each business. For your business, this document should answer these four questions:
- What personal data does the business hold?
- What is the purpose behind it?
- For what duration does the business need to keep it?
- What happens to the data after its holding period?
With the help of a data retention policy, a Data Fiduciary can establish clear rules for how long the organisation will store the data before deleting it. This helps the fiduciary to stay aligned with principles of limiting data collection and retention periods.
What is Retention Under DPDP Act?
Under the DPDP Act, data retention is the legal duty of Data Fiduciaries to store personal data only as long as necessary to fulfill different purposes for which the data was collected. Once data serves its purpose or when the consent is withdrawn, the company must delete it.
When should Personal Data be Erased?
Under Section 8(7) of the DPDP Act, a Data Fiduciary must erase personal data when it can be safely assumed that the intended purpose has been fulfilled, or when the individual to whom the data is related to (Data Principal) withdraws consent; whichever is earlier. The only exception is when another law requires you to keep the data.
The erasure of data is like this:
Data Collection ➡ Usage (acc. to purpose) ➡ Kept until needed ➡ Erase when purpose ends.
What is Rule 8 for Data Retention and Erasure?
Rule 8 under the DPDP Rules 2025, gives timelines for when a business should delete the data and when it can retain the data.
The following are the main data retention and erasure rules. Your business’ data retention policy should be built around these points:
The Three-Year Inactivity Rule (Third Schedule)
Many businesses think the DPDP Rules fix a three-year retention limit for everyone. But it is not applicable to everyone.
Under the DPDP Rules, large platforms must delete a user’s personal data after three years of complete inactivity or lack of interaction. These large platforms are:
| Platform Type | User Threshold |
| E-commerce firms | 20 million or more registered users |
| Online gaming platforms | 5 million or more registered users |
| Social media intermediaries | 20 million or more registered users |
If you are one of the above platforms, and a user has not interacted with you for three years, you need to start the erasure process.
If you are not one of the platforms stated above, you cannot rely on the three year rule. The general Section 8(7) rule still applies to you, that is, keep data only while the purpose lasts.
The 48-Hour Notice [Rule 8(2)]
Business cannot delete the user data just because user is inactive . Rule 8(2) says that the user must receive a warning at least 48 hours before their data is deleted.
The notice of warning should tell the user that their data will be deleted unless they log in to their account or contact you. If they respond, deletion does not go ahead.
It is recommended that the warning be given through different mediums (SMS, email). You could also keep a timestamp record for every notice you issue.
Minimum Log Retention Period [Rule 8(3)]
The fiduciaries must keep the personal data, related traffic data, and logs of processing for at least one year from the date of processing. After that, fiduciaries must erase them, unless another law (RBI, SEBI, or other Act) requires data retention.
Even if a Data Principal asks to delete all of their data, logs may serve as evidence if the Data Protection Board investigates. Logs provide privacy, security, and legal readiness.
Legal Exceptions
Businesses can retain data even after the original purpose is fulfilled or consent is withdrawn, if other laws require it, like the Companies Act, 2013, the CGST Act, 2017, RBI, and other applicable laws.
How Long Can You Keep Personal Data Under DPDP Act?
Under the DPDP Act, there is no specific single retention period for personal data. Instead, the data must be deleted as soon as the specified collection purpose is fulfilled or the consent by the Data Principal is withdrawn.
Still, these are some of the specific timelines under the DPDP Rules:
- 1 Year – The access logs and processing records must be kept for one year. It is the minimum time period for retention.
- 3 Years – Some specific large digital platforms must delete the user’s data if they are inactive for 3 years.
- 7 Years – Consent Managers must store complete audit trails of all consent events, when the consent was given, modified, or withdrawn—for a minimum of 7 years.
A business can follow this data deletion process:
- What data do you hold, and why? Connect each data type to its purpose.
- Who has the data? List all processors and systems.
- When should it be deleted? Apply the right trigger and period.
- How will you verify it? Ask for proof of deletion from third parties.
What should a data retention policy include?
A data retention policy for any business should define:
Company’s Objectives
State the reasons for storing the data. It should cover the legal, regulatory, and operational requirements.
Systems and Records
Specify all the databases, systems, and physical records where personal data could be stored.
Risk-based data classification
A risk-based profiling is needed because not all data carries the same risk, so it shouldn’t be kept for the same length of time.
Retention Timeline
A retention schedule turns your policy into simple, practical rules. It states exactly how long each type of data is kept and when it must be deleted. It aligns the timeline with different rules.
Data Ownership
It tells about who is responsible for each set of data. With clear ownership, it is easy to decide how long data is kept, when it should be deleted, and whether the retention rules are actually being followed.
Storage Locations
Listing where data is throughout servers, cloud, backups, emails, or devices helps to confirm whether the data is deleted once the retention period ends.
Legal Data Holding
The policy should define if any law mandates it to keep it past its retention period.
Deletion Process
Clear steps to show who deletes the data, how it is erased, and how the deletion is recorded. It helps in proving compliance.
Deletion for any business needs to be a repeating cycle, not a one-time cleanup. Find your data, sort it, set periods, watch for triggers, delete, and keep proof. Below are the common mistakes to avoid while deleting the data:
- Keeping data forever.
- Treating three years as a baseline rule.
- Deleting logs too early.
- Forgetting backups and old systems.
- Leaving processors out.
- Having a policy but no process.
Getting this wrong can be costly. Under the DPDP Act, you can be fined up to ₹250 crore if you fail to put reasonable security safeguards in place. The stored data that is not in use also brings threats like breaches.
Build a Data Retention Policy with DPDP.ai
Drafting a retention policy is easy, but following it every day is the hard part. This is where DPDP.ai steps in.
DPDP.ai helps you put retention rules into practice by automating data discovery, consent-to-purpose mapping, and deletion workflows. It finds personal data across your systems, links each record to its purpose, and sets a retention period.
It also supports Rule 8, including the 48-hour deletion notice, the three-year inactivity rule, and one-year log retention.
With DPDP.ai deletion runs on schedule, and every action is recorded, giving you clear proof of compliance.
Conclusion
Under the DPDP Act, retention depends on purpose, not storage. Keep personal data till the real purpose or legal duty tells you to and delete it when that ends.
Rule 8 adds the details: a 48-hour deletion notice, a three-year inactivity period for large platforms, and one-year log retention.
To follow the retention laws, businesses must map data, set retention periods, and build deletion into their systems. A clear policy, backed by a working process, protects users and gives you proof of compliance.
FAQs
Ques: What is the data retention period under the DPDP Act?
Ans: There is no fixed retention period for all personal data under the DPDP Act. The retention period depends on its purpose fulfillment. The minimum is one year for logs, and the three-year rule applies only to large platforms.
Ques: How is personal data deleted under the DPDP Act?
Ans: Personal data should be erased when its purpose is completed or consent is withdrawn by the individual. The only exception is when the law requires you to keep the data.
Ques: What is the data retention three-year rule?
Ans: According to Rule 8(1), it is a rule that is applied only to certain large e-commerce, online gaming, and social media platforms. This rule says that these platforms must delete user personal data if the user is inactive for three years continuously.
Ques: Do companies keep logs even after a deletion request?
Ans: Yes, most of the time. Companies keep system logs, audit trails, and compliance records. The companies keep it even if a Data Principal has submitted a formal deletion request.
Ques: Do data processors have to delete personal data?
Ans: Yes. Data Processors must also delete personal data. They have to delete personal data, when instructed by the data fiduciary. They also need to delete it when the contract between them ends.
Ques: What is a data retention and deletion policy?
Ans: It is a policy that discloses for how long any organisation will keep personal data in their systems and how the data will be erased securely after its purpose is served or consent is withdrawn by the individual to whom the personal data is related to (data principal).
Ques: What does the data retention policy in India require?
Ans: Under the DPDP Act, data must be erased when consent is withdrawn or the purpose is served. The only exception is unless any law requires it to be kept.
