Rule 8
Retention, erasure, and the pre-erasure warning
Fixes when the specified purpose is deemed no longer served for listed classes, requires a warning at least 48 hours before erasure, and sets a one-year minimum log retention.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- A Data Fiduciary of a class specified in the Third Schedule, processing for the corresponding purposes, must erase personal data after the corresponding period unless retention is required by law, where the Data Principal has neither approached it for the performance of the specified purpose nor exercised her rights.
- (2)
- At least forty-eight hours before the period completes, the Data Fiduciary must inform the Data Principal that the data will be erased unless she logs in, initiates contact, or exercises her rights.
- (3)
- Separately, a Data Fiduciary must retain personal data, associated traffic data and logs for at least one year for the Seventh Schedule purposes, after which they must be erased unless another law requires longer retention.
In practice
Sub-rules (1) and (3) pull in opposite directions and both apply: erase the dormant account data on the Third Schedule clock, but keep logs for a year regardless. A retention policy that treats all data the same fails one of them. The forty-eight hour warning in (2) is also a product feature rather than a legal document, since it has to reach the user before the deletion runs.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 8 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.