Section 8(7) · Rule 8
Retention and erasure under DPDP
Personal data should go when consent is withdrawn or the purpose is no longer served. TruePrivacy runs your retention rules and logs what they did.
Sample workspace
Retention rules
- Marketing leads180 days from last_contact
- Support tickets365 days from closed_at
- Consent and access logsAt least 1 year
- LogsRule 8(3)
Executions
- Rule ran on crm-db: 312 records
- 14 items flagged for manual purge
- Approval needed: support tickets
Short answer
Under s.8(7) of the DPDP Act, a Data Fiduciary erases personal data, and has its processors erase it, when consent is withdrawn or the specified purpose is no longer served, unless a law requires retention. Rule 8 sets a three-year timeline with 48 hours' notice for classes in the Third Schedule, and Rule 8(3) keeps personal data, traffic data and logs of processing for at least one year for the Seventh Schedule purposes. TruePrivacy runs retention rules per data category, connected system or processing activity, with an executions log.
What retention rules do
Set rules per data category, connected system or processing activity.
Keep data for a set number of days from a date field, then take an action on expiry.
Require approval before the expiry action runs.
Each run is logged, so you can show what happened and when.
Items that need a manual purge are flagged for your team.
Audit, access and consent logs are kept for at least one year (Rule 6, Rule 8(3)).
How to set a retention rule
Start from your purposes. The purpose limitation list tells you why you hold each kind of data, and the records of processing show where it sits.
- 01Decide the period
For each purpose, decide when it is no longer served, and check whether another law requires you to keep the data.
- 02Write the rule
Choose a data category, connected system or processing activity, a date field, a number of days and the action on expiry.
- 03Approve and run
Add an approval step if you need one. Each run is logged in the executions log.
- 04Close the gaps
Work through items flagged for manual purge, and make your processors erase their copies (s.8(7)).
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Erase when consent is withdrawn or the purpose is no longer served | s.8(7) | Retention rules with an action on expiry and an executions log |
| Make processors erase | s.8(7) | Flags items needing a manual purge; vendor records list your processors |
| Erasure on request | s.12 | Erasure requests fanned out as tasks to connected systems; see rights requests |
| Three-year timeline and 48 hours' notice for Third Schedule classes | Rule 8 | Rules keyed to a date field you choose |
| Keep logs for at least one year | Rule 6, Rule 8(3) | Audit, access and consent logs kept for at least one year |
Retention decisions stay with you
TruePrivacy runs the rules you set; when a purpose ends, and which law requires you to keep data, are your decisions. Rule 8's three-year timeline applies to e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh such users. If it applies to you, plan how you will give at least 48 hours' notice before erasure.
Sector regulators may have their own rules. Check your regulator's directions alongside DPDP before you shorten any retention period.
Works with
When must personal data be erased under DPDP?
When the Data Principal withdraws consent or the specified purpose is no longer served, unless a law requires you to keep it (s.8(7)). You must also have your processors erase it.
What is the three-year rule in Rule 8?
For classes in the Third Schedule, personal data is erased three years after the Data Principal last approached you or exercised rights, or from commencement if later, with at least 48 hours' notice before erasure.
How long should logs be kept?
Rule 6 asks for logs and personal data to be kept for one year to detect and investigate unauthorised access, unless another law requires otherwise, and Rule 8(3) asks for at least one year for the Seventh Schedule purposes.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin