How to Set Retention and Erasure (Rule 8)

Keep personal data only as long as the purpose needs it, then erase it. Section 8(7) applies to everyone. Rule 8 and the Third Schedule add fixed periods for very large platforms and a one-year log rule for all. This DPDPA 2023 course page explains how to set retention and in plain language.

Does the Third Schedule apply to you? (how to set retention and)

Thresholds: 2 crore (e-commerce), 50 lakh (online gaming), 2 crore (social media) registered users in India.

Rules in plain words

• Everyone: erase data when consent is withdrawn or the purpose is served, unless a law requires you to keep it (Section 8(7)).
• Everyone: keep personal data, associated traffic data and logs for at least one year for security and investigation needs (Rules 6 and 8).
• Large platforms: erase data of users who have not contacted you or used the service for 3 years, after giving at least 48 hours notice. The notice is not needed if the user logs in or reaches out.

Build a retention schedule (how to set retention and)

Step by step

1. Use your inventory to list each data type and purpose.
2. Decide the shortest period that works, and note any legal retention duty.
3. Set automatic deletion where tools allow (email, CRM, cloud storage rules).
4. For manual stores, set a calendar reminder each quarter.
5. Tell processors to delete too and get confirmation.
6. Handle backups: let them expire on their normal cycle and document it.
7. If you are a large platform, add the 48-hour warning message.

48-hour erasure warning template (how to set retention and)

We have not seen activity on your account for 3 years. In 48 hours we will erase your personal data. To keep your account, simply log in or contact us at [email] before [date and time].

Related guides

• Data Inventory
• Security Safeguards

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.