Third Schedule
Retention periods by class of Data Fiduciary
Three classes of large platform, each with a three-year erasure period running from the Data Principal’s last contact.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- 01
- An e-commerce entity with at least two crore registered users in India: three years from the Data Principal’s last approach for the specified purpose, her last exercise of rights, or the commencement of the Rules, whichever is latest.
- 02
- An online gaming intermediary with at least fifty lakh registered users in India: the same three-year period.
- 03
- A social media intermediary with at least two crore registered users in India: the same three-year period.
- 04
- The period does not apply to data that enables the Data Principal to access her user account, or to access virtual tokens stored with the Data Fiduciary that can be used for money or goods.
In practice
The user thresholds mean this Schedule binds a small number of very large platforms, and every other business erases under s.8(7) on the ordinary purpose-served test instead. Being outside the Schedule is not an exemption from erasure, only from this fixed clock.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Third Schedule is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.