Table of contents
By-Research Team
October 20, 2026 | 10 min read | DPDP
Data Retention and Deletion Guide for DPDP Act
How long should an organisation retain personal data, and when should it delete it? These decisions require businesses to balance their operational needs with applicable privacy and recordkeeping requirements.
India’s Digital Personal Data Protection (DPDP) Act, 2023, and the DPDP Rules, 2025 set out requirements relevant to these decisions. With different commencement dates for different provisions, organisations must understand the applicable requirements and prepare for upcoming obligations.
This guide explains the legal framework for data retention and deletion, how to determine appropriate retention periods, the specific requirements under Rule 8, and how to address retention obligations under other Indian laws.
What Is Data Retention and Data Deletion?
Data retention is the continued storage of personal data for a specified purpose or period. For example, an e-commerce business may retain a customer’s order details to process returns and meet applicable accounting requirements.
Data deletion or erasure involves removing personal data when the applicable deletion trigger arises and no valid retention requirement prevents it. For example, once the relevant retention period for the customer’s order records ends, the business should erase the personal data it no longer needs, unless another legal obligation requires it to be retained.
What Does the DPDP Act Say About Data Retention and Deletion?
Sections 8 and 12 of the Digital Personal Data Protection (DPDP) Act, 2023 address when personal data must be erased and how Data Principals can request erasure. These provisions operate alongside applicable legal retention requirements and the relevant Rules and commencement notifications.
When Must Personal Data Be Erased?
Under Section 8(7), a Data Fiduciary must erase personal data when consent is withdrawn or when the specified purpose is no longer being served, whichever happens first. However, data may be retained when required to comply with a law in force.
Section 8(8) explains when a purpose may be considered complete, including cases where the individual has not contacted the organisation or exercised their rights for the prescribed period. The applicable Rules set additional requirements for certain types of Data Fiduciaries and purposes.
There is no single inactivity period for every organisation.
Example: If a customer withdraws consent for promotional emails, the business must stop the relevant consent-based processing. However, this does not automatically mean that all records related to the customer must be erased.
How Should Businesses Handle Erasure Requests?
When an individual requests erasure under Section 12, the organisation should follow a clear process to identify the data, assess the request and take the appropriate action.
A practical erasure process includes:
- Receive the request: Identify the individual making the request.
- Find the data: Locate the relevant personal data across the organisation’s systems.
- Assess the request: Identify which data is covered and check whether any law requires certain records to be retained.
- Take action and document it: Erase the relevant data and record the outcome, including reasons for retaining any data that cannot be erased.
- Verify completion: Check that the action has been completed across relevant systems and, where applicable, by Data Processors.
Data Fiduciaries remain responsible for processing carried out by Data Processors on their behalf. Therefore, the erasure process should also cover relevant third-party systems and service providers, not just the organisation’s own systems
How Long Can an Organisation Retain Personal Data Under the DPDP Act?
The appropriate period depends on the specified purpose, applicable legal obligations and the relevant provisions of the Act and Rules. Businesses should document why each category of personal data is retained and when its retention should be reviewed.
Does the DPDP Act Specify a Fixed Data Retention Period?
No. The DPDP Act does not set one fixed retention period, such as one or three years, for all organisations and types of personal data.
Retention periods may vary depending on the type of record, its purpose and applicable legal requirements. For example, certain statutory records may need to be retained even after the original business purpose has ended.
How Should Businesses Determine Retention Periods?
Businesses should create a retention schedule that links each category of personal data to its purpose, applicable legal requirements and deletion trigger.
Follow these six steps:
- Identify the data category: Separate customer records, employee information, marketing data, transaction records and other personal data.
- Document the purpose: Clearly state why the data is collected and processed.
- Check applicable laws: Identify any statutory or regulatory retention period that applies to the record.
- Define the retention trigger: Determine when retention should end, such as when the purpose is fulfilled or a legally required period expires.
- Document exceptions: Record why specific data must be retained beyond the normal deletion trigger and when the exception should be reviewed.
- Implement and review: Put the schedule into practice through documented procedures and, where feasible, automated retention and deletion controls.
Rule 8 of the DPDP Rules, 2025: What Businesses Need to Know
Rules 6 and 8 of the DPDP Rules, 2025 set specific requirements for retaining and erasing personal data. Rule 8 covers inactivity-related erasure periods and advance notices for certain Data Fiduciaries. It is scheduled to commence in May 2027
Which Data Fiduciaries Are Covered by the Third Schedule?
The Third Schedule covers these classes of Data Fiduciaries:
- E-commerce entities: At least two crore registered users in India.
- Online gaming intermediaries: At least 50 lakh registered users in India.
- Social media intermediaries: At least two crore registered users in India.
For specified purposes, these organisations must follow a three-year inactivity period, calculated from the Data Principal’s last relevant interaction or exercise of rights, or commencement of the Rules, whichever is later. Certain account-access purposes and qualifying virtual tokens are excluded.
This is not a universal three-year retention rule for all businesses.
What Is the 48-Hour Advance Notice Requirement?
Under Rule 8(2), covered Data Fiduciaries must notify individuals at least 48 hours before the applicable erasure period ends. The notice must explain that their personal data will be erased unless they log in, contact the organisation for the specified purpose or exercise applicable rights.
What Are the One-Year Retention Requirements?
Rules 6 and 8 contain separate requirements to retain certain data and logs for at least one year:
- Rule 6(1)(e): Covers specified security-related purposes.
- Rule 8(3): Covers purposes listed in the Seventh Schedule.
The requirements have different scopes. Businesses must identify which provision applies rather than assume that all personal data must be kept for one year.
How Do Businesses Reconcile DPDP Requirements with Other Indian Laws?
Businesses must assess data retention and deletion obligations alongside other laws that apply to their records. Section 8(7) recognises retention necessary to comply with a law in force as an exception to its erasure obligation. The appropriate retention period depends on the specific record, applicable legislation and relevant circumstances.
Which Other Laws May Require Records to Be Retained?
Businesses must consider recordkeeping requirements under other Indian laws when deciding whether personal data can be deleted. These may include the Prevention of Money-Laundering Act (PMLA), RBI’s KYC Directions and regulations issued by the Securities and Exchange Board of India (SEBI).
- PMLA and KYC requirements: The PMLA, 2002, and the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 require regulated entities to maintain specified transaction and customer identity records. RBI’s KYC Directions generally require transaction records to be retained for at least five years from the transaction date and customer identification records for at least five years after the business relationship ends.
- RBI regulations: RBI-regulated banks and financial institutions must follow applicable recordkeeping requirements, including those under the RBI KYC Directions. The specific requirements depend on the type of institution and record.
- SEBI regulations: Certain SEBI-regulated entities, such as depositories and their participants, must preserve specified records for a minimum of five years. Other requirements may apply depending on the type of intermediary and record involved.
Example: Balancing KYC Retention With Data Deletion
Suppose a customer closes a bank account and requests the deletion of their personal data. The bank may still need to retain specified KYC and transaction records for the periods required under applicable regulations. It should retain those records for compliance purposes and restrict unnecessary access or use.
However, the retention requirement does not automatically justify keeping every piece of the customer’s personal data indefinitely. Information that is no longer needed and is not subject to another valid retention requirement should be assessed for deletion under the applicable DPDP provisions.
What Are the Risks of Excessive Retention or Premature Deletion?
Poor retention decisions can expose businesses to avoidable security incidents, regulatory issues, operational inefficiencies and gaps in business records. Keeping unnecessary data increases the volume of information that must be protected, while deleting records too early can disrupt audits, investigations or legally required recordkeeping. Both can create preventable business risks.
Risks of Retaining Personal Data Longer Than Necessary
1. Greater Impact of a Data Breach
Keeping unnecessary personal data increases the amount of information that could be exposed in a security incident. Old customer records, unused databases and outdated exports can add to this exposure.
2. Higher Storage and Management Costs
Accumulating outdated records across databases, email archives and third-party platforms increases storage costs and makes searches, audits and internal reviews more time-consuming.
3. Reduced Visibility and Accountability
When businesses cannot explain why personal data is still being retained, it becomes harder to track records, assess risks and demonstrate effective data governance.
Risks of Deleting Personal Data Too Early
1. Regulatory and Legal Consequences
Deleting records before the required retention period ends can prevent a business from meeting its legal or regulatory obligations and may result in compliance issues or penalties.
2. Loss of Important Business Records
Premature deletion can remove records needed for audits, financial reconciliation, customer disputes or ongoing investigations. Recovering this information may be difficult or impossible.
3. Disruption to Business Operations
Missing records can affect customer service, transaction verification and decision-making. Teams may need to reconstruct lost information, leading to delays and additional work.
Conclusion
Data retention and deletion are essential parts of privacy governance. Businesses need to understand what personal data they hold, why they retain it, how long it is needed and when it should be deleted.
Start by reviewing your organisation’s data, defining retention periods and identifying applicable legal requirements. Where another law requires data to be retained, document the reason and review it when circumstances change. Clear policies and practical controls can help ensure that retention and deletion decisions are applied consistently.
With the DPDP Act and Rules taking effect in stages, organisations should use the transition period to review existing practices, identify gaps and prepare for upcoming requirements. Taking these steps now can help build a more structured and effective approach to data retention and deletion.
Key Takeaways
- There is no universal retention period.
- Retention depends on the purpose, applicable legal obligations and relevant provisions of the DPDP framework.
- Deletion must be managed, not assumed.
- Organisations need clear triggers, documented procedures and appropriate verification.
- Rule 8 has a defined scope.
- Its inactivity-related requirements apply to specified classes and purposes. The relevant one-year retention provisions also have defined scopes.
- Other laws may require continued retention.
- Businesses should identify and document the applicable legal basis before retaining data beyond the ordinary deletion trigger.
- Policies need operational support.
- Data inventories, retention schedules, processor coordination and deletion evidence help translate written requirements into consistent practice.
Related Blog
