Data Privacy · DPDP Act 2023

Retention & erasure — how long you may keep personal data

A few items on this page are marked Confirmation pending. What’s pending

Rule 8 and the Third Schedule set concrete retention and erasure timelines for large e-commerce, online gaming, and social media platforms. Section 8(6)–(8) sets the broader duties: breach intimation, erasure on withdrawal, and the deemed-expiry rule.

Last updated: 1 November 2026Written and edited by Sandesh Kokate

Checked against primary sources where marked. Items marked Confirmation pending are not yet checked.

Confirmation pending on this page (3)

Last checked 1 Nov 2026 · next check 8 Nov 2026

Hospital and state record periods. Period: confirmation pending. Ask your customer’s doctor or lawyer which law applies.
The period in MCA’s Companies Act s.128(5). Period: confirmation pending. Ask your customer’s CA which law applies.
The full Income-tax Act s.62 text. Ask your customer’s CA which records and law apply. Opened Rule 46 is separate.

In plain English

Delete, but not too early

Law — s.8(7), DPDP Act 2023; Rule 8(3), DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): erase when consent is withdrawn or the purpose is no longer served, subject to legal retention. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from processing, for Seventh Schedule purposes. Then erase unless another law requires longer. The Fiduciary must ensure its Processor follows that floor (Rule 8, Illustration, Case 2).

Our reading: do not erase before the Rule 8(3) floor when applying s.8(7). The opened text does not resolve every overlap. Confirm this reading before relying on it.

Rule 8(1), Third Schedule: the three-year dormancy rule is only for e-commerce and social media firms with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. Account access and specified virtual-token access are excluded. Count from the latest relevant contact, rights exercise or Rules commencement, whichever is latest. Warn at least 48 hours before erasure (Rule 8(2)).

Good practice: write the floor and any longer legal period into the contract and deletion schedule. Agree who retains the records, returns data and confirms erasure.

s.8(7), (8); Rule 8; Third Schedule — Act · Act page 8 · Rules PDF page 27 · Rules page 35 · Rules page 36 · Corrigenda

A Data Fiduciary must plan erasure and legal retention together (s.8(7); Rule 8(3)). Do not erase before the one-year floor in that reading. Rule 8 also sets these timelines:

Rule 8(3): keep personal data, processing logs and traffic data for at least one year from processing, for Seventh Schedule purposes.
A three-year rule for very large e-commerce, online gaming, and social media platforms. For gaming, see the Online Gaming Act and Rules.

For those large platforms: if a user has not logged in or exercised her rights for three years, the platform must erase her data. But first, it must warn her at least 48 hours before deletion. The one-year retention floor still applies. This is true even if the user deletes her account or the original purpose is finished.

Think of it like

Other retention laws

Law — s.8(7), s.12(3): a required legal retention period can override erasure. These examples concern specified records, not every piece of personal data. Good practice: ask your client which law applies before deleting.

s.8(7), (8); Rule 8; Third Schedule — Act · Act page 8 · Rules PDF page 27 · Rules page 35 · Rules page 36 · Corrigenda

GST books and records that s.35(1) requires — not all personal data: 72 months from the annual-return due date for the relevant year. For proceedings or investigation, keep subject-matter records one year after final disposal or the ordinary period, whichever is later.; Law — CGST Act 2017, s.36 · text opened 2026-11-01; The CBIC link did not open on 2 November 2026. The extract above is preserved from the earlier read of 1 November 2026.
Covered income-tax books and documents, not all personal data: Seven tax years from the end of the relevant tax year. Reopened assessments extend the hold until completion. Rule 46(2)–(3) limits professional-record coverage. The full Act s.62 text remains unconfirmed here.; Law — Income-tax Rules 2026, Rule 46(1), (4), (6), (9), (10) · text opened 2026-11-01
NBFC transaction records; identification and address records: Transactions: at least five years from the transaction date. Identification and addresses: at least five years after the business relationship ends. The explanation includes account files, correspondence and analysis results.; Law — NBFC KYC Directions 2025, Chapter VII, paragraph 47(1), (2) · text opened 2026-11-01

Client confidences continue after the work ends

An advocate may not disclose protected client communications, professional advice or document information without express client consent. The duty continues after service ends. The proviso excludes illegal-purpose communications and specified observed crime or fraud. Subsection (3) also covers interpreters and advocates' clerks or employees. The text does not settle whether independent vendor staff are covered. This is confidentiality, not a rule to keep every file forever. Good practice: use strict confidentiality and need-to-know terms in vendor contracts.

Law — Bharatiya Sakshya Adhiniyam 2023, s.132(1), explanation, (3)

Confirm before relying on this

Doctors' medical records: the current numeric period was not confirmed. The 2023 conduct text must not be relied on without checking the abeyance and operative successor position.
Hospital records: applicable establishment and state rules were not confirmed. Period: confirmation pending. Ask your customer’s doctor or lawyer which law applies.
Company books: Companies Act s.128(5) could not be opened in substantive text. Period: confirmation pending. Ask your customer’s CA which law applies.
Lawyers' files: no statutory file-retention period was established. Continuing confidentiality is not a retention clock.

Think of a self-storage locker company. It must let you remove your belongings when you cancel the contract. But tax law may force it to keep a copy of the invoice for several years. A very large warehouse chain has extra duties too. It must keep security-camera logs for a fixed period. It must warn you before destroying inactive boxes. And it cannot keep your stuff forever just because you stopped visiting.

Key takeaways

s.8(7): erasure follows withdrawal or the end of purpose, subject to legal retention. Our reading includes the Rule 8(3) floor before erasure.
Every Data Fiduciary must keep personal data, traffic data, and processing logs. The minimum is one year from the date of processing.
Large e-commerce, online gaming, and social media platforms must treat most data as expired after three years.
Account access and virtual-token access are carved out of the three-year rule.
Before erasing data under Rule 8(1), the platform must warn the user. It must give at least 48 hours' notice.
The Data Fiduciary must also cause its Data Processor to erase the data it shared for processing.

What this means for you

Founders

Good practice: build your retention schedule now. Apply the Rule 8(3) floor and any longer legal period before erasure. Add the Rule 8(2) warning if the Third Schedule applies.

Freelancers

If you host or process client data, your contract must say who handles the one-year retention. It must also say who erases data when consent is withdrawn.

Creators

Apply s.8(7) erasure with the Rule 8(3) retention floor and any longer legal period. Check whether your platform meets the Third Schedule limits; a vendor's size does not make the same rule apply to you.

Status

EnforceableScheduled: these Rules start under Rule 1(4), with 13 May 2027 used for planning. Current Board operations remain unconfirmed.

Primary sources

Official text

Official text — Rule 8, DPDP Rules, 2025

RULE 8 — Time period for specified purpose to be deemed as no longer being served (DPDP Rules, 2025) 8. (1) A Data Fiduciary, who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule, shall erase such personal data, unless its retention is necessary for compliance with any law for the time being in force, or, for the corresponding time period specified in the Third Schedule, if the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing. (2) At least forty-eight hours before completion of the time period for erasure of personal data under this rule, the Data Fiduciary shall inform the Data Principal that such personal data shall be erased upon completion of such period, unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose or exercises her rights in relation to the processing of such personal data. (3) Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government. Illustration. Case 1: X, a Data Principal purchases an e-book on an e-book platform Y. Once delivery is completed, the specified purpose of processing is served. The platform Y must retain the order details, personal data, and logs of the processing (such as order confirmation, payment, and delivery events) for at least one year from the date of the transaction, even if X deletes her account. Case 2: X, a company engages a cloud service provider C as its Data Processor to host customer records. X as the Data Fiduciary, is required to ensure that the C also retains the data and associated logs for at least one year before erasure, unless any other applicable law requires a longer period.

Third Schedule — plain-English summary, not a quotation

The narrow dormancy rule and its thresholds are explained above. The official table and its definitions are on Rules PDF pages 35–36.

Third Schedule and Note — Rules PDF pp.35–36; source links above.

Official text — Section 8(6)–(8), DPDP Act, 2023

SECTION 8(6)–(8) — General obligations of Data Fiduciary, breach + erasure sub-sections (DPDP Act, 2023) (6) In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed. (7) A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,— (a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and (b) cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor. (8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data Principal does not–– (a) approach the Data Fiduciary for the performance of the specified purpose; and (b) exercise any of her rights in relation to such processing, for such time period as may be prescribed, and different time periods may be prescribed for different classes of Data Fiduciaries and for different purposes.

Quick self-check

Am I a Data Fiduciary?

Run the 2-minute self-check to see whether these retention and erasure duties apply to your product.

Run it now

Citation

Kokate, S. (2026). Retention & erasure — how long you may keep personal data. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/retention-erasure. Educational content, not legal advice.

← Back to Data Privacy hub Data Fiduciary obligations →

How we count the dates.