DPDP in practice
Keep it while there is a reason. Erase it when there is not. Prove both.
The Act ties retention to purpose. When consent is withdrawn or the purpose is spent, the data goes, unless another law requires it to stay. The Rules add fixed clocks for some platforms and a one-year floor for logs. Getting this right is mostly engineering and record-keeping.
Back to DPDP services01 · When data must go
The two events that start the erasure clock
Section 8(7): withdrawal or a spent purpose, whichever comes first.
Section 8(7) tells a fiduciary to erase personal data once the person withdraws consent or once it is reasonable to assume the purpose is no longer being served, whichever happens first. The same section makes the fiduciary cause its processors to erase what it gave them. The one exception is retention that some other law requires.
- Withdrawal
- Under section 6(6), processing must stop within a reasonable time, at your processors too, unless the Act or another law allows it without consent.
- Purpose spent
- The job is done: the order delivered, the account closed, the application decided.
- Purpose deemed spent
- Under section 8(8), a person who has not approached you or used any right for a prescribed period is treated as finished with you.
- Erasure request
- Under section 12(3), a person may ask; you erase unless the purpose or a law still needs the data.
02 · What the Rules add
Fixed clocks for some, a floor for all
Rule 8 and the Third Schedule, with rule 6 on logs.
| Rule | Who it binds | What it requires |
|---|---|---|
| Rule 8(1) and Third Schedule | E-commerce entities and social media intermediaries with at least two crore registered users in India; online gaming intermediaries with at least fifty lakh | Erase after three years from the person's last contact or last use of a right, or from the Rules' commencement if later, except to keep account access and stored-value tokens |
| Rule 8(2) | The same classes | Warn the person at least 48 hours before erasure that logging in or making contact will stop it |
| Rule 8(3) | Every data fiduciary | Keep personal data, traffic data and processing logs for at least one year from the processing, for the state purposes in the Seventh Schedule, then erase unless another law needs more |
| Rule 6(1)(e) | Every data fiduciary | Keep logs and personal data for one year to detect, investigate and recover from unauthorised access, unless law requires otherwise |
The floor surprises people
Rule 8(3) means a closed account does not always mean immediate deletion. The Rules' own example has an e-book platform keeping order, payment and delivery records for a year after the sale even if the buyer deletes her account. Plan erasure as purpose first, then floor, then delete.
03 · Other laws
When another law says keep it
The Act yields to retention required by law. Contract or habit is not law.
The Act's own illustration is a bank that must keep client identity records for ten years after an account closes: the law wins, and the bank keeps them. The same logic applies to tax records, company books, audit trails and sector rules. The test is whether a specific instrument requires the retention. A clause in your own contract, or a wish to keep data for analytics, does not.
| Where a duty to keep may come from | What it typically covers | What to confirm |
|---|---|---|
| Income-tax and GST law | Invoices, accounts and supporting records | The current period and whether it runs from the year end or the transaction |
| Companies Act, 2013 | Books of account and statutory registers | The period and the start point for your company |
| RBI, SEBI or IRDAI directions | Customer identity, transaction and policy records for regulated entities | Which direction applies to you and its period |
| Anti-money-laundering law | Identity and transaction records for reporting entities | Whether you are a reporting entity at all |
| CERT-In directions under the IT Act | System and security logs | The log period and where logs must be kept |
| Employment and labour law | Payroll, attendance and statutory filings | The state and central rules that apply |
When a law forces you to keep data, keep only what it names, restrict access to the purpose of that law, and set the erasure date from the law's period.
04 · Schedule template
A retention schedule you can work from
One row per purpose, not per system. Rows are illustrative.
| Record set (illustrative) | Purpose | Clock starts | Keep until | Reason to keep | How erased | Owner |
|---|---|---|---|---|---|---|
| Customer orders | Delivering what was bought | Delivery or return window ends | Purpose ends, then the rule 8(3) year, then any tax period | Tax law (period to confirm) | Scheduled job; processor confirmation | Commerce lead |
| Marketing contacts | Sending offers with consent | Consent withdrawn or no engagement | Withdrawal, or a dormancy period you set | Consent only | Suppression list plus deletion | Marketing lead |
| Support tickets | Resolving a request | Ticket closed | A period you set and can justify | Purpose; dispute handling | Ticketing tool retention setting | Support lead |
| Job applicants | Deciding an application | Decision sent | A short period you set, or longer with consent | Purpose; defence of claims | HR system purge | HR lead |
| Access logs | Detecting and investigating misuse | Log written | At least one year (rules 6 and 8(3)), longer if another law needs | Rules; sector directions | Log platform retention | Security lead |
05 · Processors
Your processors erase too, on your word
Section 8(7)(b) puts their erasure on you.
- Contract duty. The contract requires erasure on instruction and at the end of the service.
- Confirmation. The processor confirms what was erased, where, and when.
- Sub-processors. The duty flows down to anyone the processor uses.
- Backups. Backups expire on a known cycle, and restored data is re-erased.
- The one-year floor. The Rules' second example has a cloud host keeping data and logs for a year on the fiduciary's behalf. Your contract should say so.
06 · Proving erasure
How to show that erasure happened
Section 6(10) puts the burden of proof on you for consent. Erasure deserves the same paper trail.
- Erasure log
- What was erased, which purpose ended, the date and the system.
- Job records
- Run history for automated deletion, with counts and failures.
- Request trail
- For erasure requests: receipt, identity check, tickets per system, the reply.
- Processor confirmations
- Written confirmations kept with the request or the contract.
- Spot checks
- A periodic test: search for a sample of erased records and record that none came back.
- Deleting from the app only. Copies stay in the warehouse, analytics, email and backups.
- Erasing what the law says to keep. Over-deletion is a failure too. Check holds first.
- Keeping everything for the one-year floor. Rule 8(3) covers processing records for listed purposes, not every field forever.
- No dormancy rule. Section 8(8) treats silence as a spent purpose for prescribed classes; others still need a reasoned period.
- No proof. An erasure nobody recorded cannot be shown to the Board.
Sources: the Digital Personal Data Protection Act, 2023 (sections 6, 8 and 12, with the illustrations to section 8(7)); the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rules 6 and 8 and the Third and Seventh Schedules.
Questions about retention and erasure
Does anonymising data count as erasing it?
The Act does not say. Treat it with care.
The Act speaks of erasure and does not define anonymisation. Data that truly cannot be linked to a person is arguably no longer personal data, but the bar is high. Agree a position with counsel before relying on it.
Must we erase data the moment a person withdraws consent?
Within a reasonable time, unless a law or the Act allows keeping it.
Processing must stop within a reasonable time and erasure follows, but the Rules' one-year floor for processing records and any legal hold still apply.
Does the three-year rule apply to a B2B SaaS company?
Only if it falls in one of the three named classes.
The Third Schedule names large e-commerce, gaming and social media platforms. A business outside those still owes erasure when its purpose ends, on a period it can justify.
What about backups?
Let them expire on a known cycle and stop restored data coming back.
Rewriting backups for each erasure is rarely practical. Set a fixed expiry, restrict restores, and re-apply erasure after any restore. Record that this is the approach.
Make erasure something you can show, not just say.
A DPDP readiness assessment builds your schedule and tests erasure end to end. Counsel should confirm how the Act and the Rules apply to your contracts and sector.