s.8 · Rule 8 · Sch. III · Sch. VII
Retention and erasure
Personal data may be kept only while consent stands and the specified purpose is being served; Section 8(7) and Rule 8 then require erasure, with a forty-eight hour warning before data is erased for non-use.
The default under the Act is that data does not linger. Once the purpose is done, or consent is withdrawn, the Fiduciary and its Processors must erase, unless another law requires retention. Rule 8 fixes when the purpose is deemed no longer served for the classes in the Third Schedule, large e-commerce, gaming and social media platforms, at three years from the last approach by the Data Principal.
Rule 8(3) preserves retention for the purposes in the Seventh Schedule, and Rule 6 requires security logs to be kept for one year. Those are the legitimate exceptions; a retention policy that says "indefinitely" is not.
Questions people ask
- How long can we keep customer data after the last purchase?
- Until the purpose is no longer served. For the platform classes in the Third Schedule that is fixed at three years from the last interaction; for everyone else it is a judgment the retention policy must record.
- What is the forty-eight hour warning?
- Rule 8 requires the Fiduciary to tell the Data Principal, at least forty-eight hours before erasing for non-use, that the data will be erased unless they log in or otherwise approach the Fiduciary.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.