Template · Retention policy
Retention and erasure policy under Section 8(7)
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Section 8(7) requires a Data Fiduciary, and its Processors, to erase personal data once consent is withdrawn or the specified purpose is no longer served, unless another law requires retention. Rule 8 fixes the period for the Third Schedule classes at three years from the last approach and adds a forty-eight hour warning before erasure. The policy is where each purpose gets a period and each period gets an erasure job.
A period per purpose
The policy is a table: the data, the purpose, the ground, the retention period, the legal basis for any longer retention, and how erasure happens. "Indefinitely" is not a period. Rule 6(1)(e) separately requires security logs to be kept for one year; Rule 8(3) preserves retention for the purposes in the Seventh Schedule.
What a checklist misses
A checklist asks whether a retention policy exists. The Act asks whether the data was actually erased, by you and by your processors, when the purpose ended, and whether the Data Principal got the forty-eight hour warning where Rule 8 applies.
What the policy must cover
- 01Every purpose, with its periodA retention period for each purpose, and the point at which it is deemed no longer served.Section 8(7)(a), Rule 8(1)
- 02Withdrawal triggerErasure within a reasonable time after consent is withdrawn.Section 6(6), Section 8(7)(b)
- 03Legal retention exceptionsWhich data is kept longer, under which law, for how long.Section 8(7), Section 12(3)
- 04ProcessorsHow each processor is made to erase, and how it confirms.Section 8(7), Section 8(2)
- 05The warningA notice at least forty-eight hours before erasure for non-use, where Rule 8 applies.Rule 8(2)
- 06LogsSecurity logs retained one year, then de-identified or erased.Rule 6(1)(e)
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Data retention and deletion schedule. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
2. MASTER RETENTION TABLE
Each data domain is governed by the rule below. Where no rule exists for a domain, the most restrictive applicable rule is applied until this schedule is updated.
Rule 1
Data domain: Customer account data
Retention period: Until account closure, then erased
Legal / Regulatory basis: Section 8(7)
Deletion method: Secure deletion
Department / Role that owns this: Customer operations
Rule 2
Data domain: Order and invoice records
Retention period: 8 years
Legal / Regulatory basis: Companies Act 2013, Section 128(5)
Deletion method: Secure deletion
Department / Role that owns this: Finance
Rule 3
Data domain: Website access logs
Retention period: 1 year
Legal / Regulatory basis: Rule 6(1)(e)
Deletion method: Automated purge
Department / Role that owns this: Engineering
4. ERASURE MECHANICS
Erasure is triggered by:
Purpose served, Consent withdrawn, Retention period ends
Automation level of the erasure process: Automated with manual review.
Data Principals are notified at least 48 hours before scheduled erasure, as required by the DPDP Rules, 2025. Notice is sent by: Email, In-app notification.
Every erasure is logged with timestamp and operator ID in an immutable erasure log, providing audit-ready proof of compliance.
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample rows
The shape of the table. Gevox keeps this as the ROPA in each client workspace.
Enquiry form
Name, email, message. Purpose: respond to the enquiry. Ground: Section 7(a). Retained: 12 months from last contact, then erased by scheduled job. Processor: form provider, erases on API call.
Newsletter
Email address. Purpose: send the newsletter. Ground: consent. Retained: until withdrawal, then erased within 7 days. Processor: email provider.
Billing records
Name, address, amount, payment reference. Purpose: invoicing. Retained: 6 years after the financial year, required by tax law. Not subject to erasure on request during that period.
Questions people ask
- Can we keep data "in case we need it"?
- No. Retention needs a purpose being served or a law requiring it, under Section 8(7).
- Does the three-year rule apply to us?
- Only to the Third Schedule classes: large e-commerce, online gaming and social media intermediaries above the stated user thresholds. Everyone else sets and records their own periods.
- What about backups?
- Backups are storage, which is processing. The policy should state how erased data ages out of backups and within what period.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.