Glossary
What is retention under DPDP?
Retention is how long you keep personal data. DPDP ties it to the purpose, with a few fixed periods in Rule 8.
Definition
Retention is how long a Data Fiduciary keeps personal data. Under s.8(7) of the DPDP Act, 2023, it must erase personal data once consent is withdrawn or the specified purpose is no longer served, unless a law requires retention. Rule 8 sets when a purpose is deemed no longer served for Third Schedule classes, with at least 48 hours' notice before erasure, and Rule 8(3) requires certain personal data, traffic data and logs to be kept for at least one year.
What it means
Keep personal data while the purpose is served or a law requires it, then erase it and make your processors erase it (s.8(7)). See erasure and duties of a Data Fiduciary.
Rule 8(3) and Rule 6 also set a one-year floor for certain personal data and logs, shown below.
Where it appears in the Act and Rules
| Provision | What it says |
|---|---|
| s.8(7) | Erase when consent is withdrawn or the purpose is no longer served, unless law requires retention |
| Rule 8, Third Schedule | E-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh: erase three years after the Data Principal last approached the fiduciary or exercised rights (or from commencement, if later) |
| Rule 8 | At least 48 hours' notice before erasure |
| Rule 8(3), Seventh Schedule | Personal data, traffic data and logs of processing kept for at least one year |
| Rule 6 | Logs and personal data kept for one year to detect and investigate unauthorised access |
Common misconceptions
- “Keep everything, just in case.” s.8(7) requires erasure once the purpose is no longer served, unless a law requires retention.
- “The three-year rule applies to everyone.” Only to the Third Schedule classes.
- “Logs can be deleted straight away.” Rule 8(3) and Rule 6 require certain logs to be kept for at least one year.
Related terms
Deleting personal data on request or when the purpose ends (s.8(7), s.12).
Purpose limitationUsing personal data only for the specified purpose (s.4, s.6, s.8(7)).
ProcessingAny wholly or partly automated operation on digital personal data (s.2).
Data ProcessorProcesses personal data on behalf of a Data Fiduciary (s.2).
In TruePrivacy
Retention rules apply per data category, connected system or processing activity: keep for N days from a date field, then an action on expiry, optionally with approval. An executions log records each run, items needing a manual purge are flagged, and audit, access and consent logs are kept for at least one year.
How long can I keep personal data under DPDP?
Until the specified purpose is no longer served or consent is withdrawn, unless a law requires you to keep it (s.8(7)). Rule 8 sets a three-year period for Third Schedule classes.
What is the one-year retention in Rule 8(3)?
Personal data, traffic data and logs of processing are retained for at least one year for the purposes in the Seventh Schedule.
Who is covered by the Third Schedule?
E-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh registered users in India.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin