India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organisations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymise it.
A key principle under the DPDP framework is that personal data should not be retained indefinitely merely because it may be useful in the future. The DPDP Act links retention to the purpose for which personal data is processed, while the DPDP Rules prescribe more specific retention and erasure mechanisms for certain categories of processing.
Are you a Significant Data Fiduciary?
Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF.
Importantly, the framework is being implemented in phases. The DPDP Rules were notified on 13 November 2025, and the substantive provisions relating to data retention and erasure are scheduled to come into force on 13 May 2027, eighteen months from notification. This gives organisations a defined preparation window, but not a reason to defer compliance planning.
The DPDP Act and the principle of purpose-based retention
Section 8(7) of the DPDP Act establishes the basic rule for retention and deletion. A Data Fiduciary must erase personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, unless retention is necessary for compliance with another law in force. The Data Fiduciary must also ensure that personal data made available to a Data Processor is erased by the processor.
This represents a shift away from indefinite or convenience-based retention. A business should therefore be able to explain, for each category of personal data:
- what purpose the data is being processed for;
- what legal basis permits the processing;
- how long the data needs to be retained;
- what event triggers deletion; and
- whether another law requires the data to be retained for a longer period.
For example, customer information collected to fulfil an online purchase should not automatically remain indefinitely in a customer database after the transaction and associated legal obligations have concluded.
What does Rule 8 of the DPDP Rules provide?
Rule 8 of the DPDP Rules provides the principal operational framework for determining when a specified purpose is treated as no longer being served. For certain classes of Data Fiduciaries and purposes identified in the Third Schedule, personal data must be erased after the prescribed period where the Data Principal has neither approached the Data Fiduciary for performance of the specified purpose nor exercised her rights in relation to the processing. At least 48 hours before the expiry of the applicable period, the Data Fiduciary must inform the Data Principal that the data will be erased, subject to specified circumstances such as the Data Principal logging into the account, initiating contact or exercising her rights.
The Third Schedule currently identifies three categories of large digital platforms:
- E-commerce entities with at least two crore registered users in India;
- Online gaming intermediaries with at least fifty lakh registered users in India; and
- Social media intermediaries with at least two crore registered users in India.
For these entities, the specified personal data is generally subject to a three-year period calculated from the later of the relevant date of the Data Principal’s last approach/exercise of rights or commencement of the DPDP Rules. The three-year mechanism does not apply to personal data retained for enabling the Data Principal to access her user account or to access specified virtual tokens.
The one-year retention requirement
Rule 8 also introduces a separate minimum retention requirement. For processing undertaken by a Data Fiduciary or on its behalf by a Data Processor, the Data Fiduciary must retain the relevant personal data, associated traffic data and other processing logs for a minimum period of one year from the date of processing, for the purposes specified in the Seventh Schedule. Following that period, the Data Fiduciary must cause the data and logs to be erased unless further retention is required by another law or notified by the Government.
This requirement should not, however, be misunderstood as a general licence to retain every category of personal data for one year. The one-year requirement operates within Rule 8(3) and its specified purposes. For other business processing, the overarching principle remains purpose-based retention and erasure under the DPDP Act.
Accordingly, organisations should avoid adopting a blanket “retain everything for one year” policy. Instead, retention periods should be mapped to particular data sets, purposes, legal requirements and regulatory obligations.
What happens where another law requires longer retention?
The DPDP framework expressly recognises that personal data may need to be retained to comply with other laws. Section 8(7) permits continued retention where it is necessary for compliance with a law in force. The DPDP Act itself illustrates this principle by referring to banking records that may be required to be retained for a longer statutory period.
Consequently, businesses should not develop their DPDP retention schedules in isolation. Depending on the sector and nature of the information, organisations may need to consider requirements under, among others, tax laws, corporate and accounting laws, employment regulations, financial-sector regulations, anti-money laundering requirements, consumer laws and sector-specific record-keeping obligations.
The appropriate approach is therefore to identify the longest legally required retention period for each relevant category of data, while ensuring that data is not retained beyond what is otherwise legally or operationally justified.
Retention must extend beyond the primary database
A common compliance gap is treating deletion from the principal production database as equivalent to complete deletion.In practice, personal data may exist across:
- customer relationship management systems;
- cloud storage;
- email systems;
- analytics platforms;
- data warehouses;
- application logs;
- search indexes;
- testing environments;
- archived records;
- backups; and
- systems operated by Data Processors.
The DPDP framework places obligations on the Data Fiduciary in relation to processing undertaken by Data Processors. Rule 8 expressly contemplates processing carried out by or on behalf of a Data Fiduciary and requires the Data Fiduciary to cause the relevant data and logs to be erased in accordance with the applicable requirements. Organisations should therefore examine whether their contracts with vendors, cloud providers and other processors contain appropriate provisions dealing with retention, deletion, return of data, audit rights and assistance with Data Principal requests.
May 2027: The key compliance deadline
The most important update for businesses is the 13 May 2027 implementation date. The DPDP Rules were notified on 13 November 2025. Under Rule 1, Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. Separately, the Government’s commencement notification places Sections 3 to 5, Sections 6(1) to 6(8) and (10), Sections 7 to 10, Sections 11 to 17, Section 27 (except Section 27(1)(d)), Sections 28 to 34, Sections 36 and 37, and Section 44(2) of the DPDP Act in the eighteen-month phase.
Accordingly, 13 May 2027 should be treated as a major organisational readiness milestone for substantive DPDP compliance, including the retention and erasure framework. As of September 2026, organisations have approximately eight months to move from policy-level preparation to operational implementation.
Other implementation developments to watch
The compliance landscape is also developing institutionally. The Data Protection Board of India (“DPBI”) was formally established on 13 November 2025. The Government subsequently initiated steps for appointment of its Chairperson and Members, including a May 2026 communication concerning appointment to the statutory posts. The DPBI is intended to function as the adjudicatory authority under the DPDP framework.
The phased implementation also means that businesses should monitor developments beyond retention and deletion. For example, Rule 4, dealing with registration and obligations of Consent Managers, is scheduled to take effect one year after notification of the Rules, i.e., on 13 November 2026. The staggered commencement means that DPDP compliance should be treated as an ongoing implementation programme rather than a single exercise undertaken immediately before May 2027.
What should businesses do now?
Businesses should use the period before May 2027 to establish a defensible data lifecycle framework. Key steps include:
1. Conduct a data inventory: Identify what personal data is collected, where it is stored, who can access it and which processors handle it.
2. Map purposes and retention periods: Link each category of personal data to a specified purpose and determine the appropriate deletion trigger.
3. Identify overriding legal requirements: Create a matrix of statutory and regulatory retention obligations applicable to each business function.
4. Review processor arrangements: Ensure vendor agreements address retention, deletion, return of data and assistance with data subject requests.
5. Automate deletion where possible: Build systems capable of identifying records that have reached their applicable retention period and triggering deletion or irreversible anonymisation.
6. Address secondary environments: Extend the retention and deletion analysis to backups, archives, analytics environments, logs and testing systems.
7. Document exceptions: Legal holds, regulatory investigations and statutory retention requirements should be documented and subject to controlled approval.
8. Maintain evidence: Organisations should retain records demonstrating how retention periods were determined and how deletion controls operate.
Conclusion
The DPDP framework introduces a more structured approach to the lifecycle of personal data in India. The central principle is straightforward: personal data should not be retained indefinitely once the purpose for processing has been fulfilled, subject to legally required retention and the specific mechanisms prescribed under the DPDP Rules. The notified Rules add greater specificity through the one-year retention requirement for specified processing and the three-year inactivity-based erasure framework applicable to certain large digital platforms.
With 13 May 2027 now established as the key commencement date for the substantive retention and erasure framework, organisations should not wait until the deadline to address data lifecycle management. Data inventories, retention schedules, processor contracts and automated deletion mechanisms can take considerable time to implement, particularly for organisations operating multiple legacy systems.
A well-designed retention programme should therefore be viewed not merely as a privacy-policy exercise, but as an integrated legal, operational and technology control that enables organisations to demonstrate accountability under India’s emerging data protection regime.
Frequently Asked Questions
1. How long can businesses retain personal data under the DPDP Act?
2. What is the one year retention requirement under Rule 8 of the DPDP Rules?
3. Which businesses fall under the three year erasure rule in the Third Schedule?
4. When does the DPDP retention and erasure framework come into force?
5. Does the DPDP Act override other laws that require longer data retention?
Explore KSK Data Privacy Hub
Free compliance tools and expert guidance covering 75+ jurisdictions.