Lesson 7.3: Retention and erasure: Rule 8 and the Third Schedule

Module 7 · Lesson 7.3 of 8 · About 30 minutes · Rule 8 and the Third Schedule

Do not keep data longer than you need. Some large platforms have a fixed clock. This DPDPA 2023 course page explains rule 8 and the third schedule in plain language.

rule 8 and the third schedule - DPDPA 2023 course lesson banner

What you will learn about rule 8 and the third schedule

Set retention periods
Apply the Third Schedule
Give the 48-hour warning

The rule (rule 8 and the third schedule)

Erase personal data when the purpose is no longer served or consent is withdrawn, unless law requires retention. For specified large classes, the Third Schedule sets a time limit. E-commerce entities with at least 2 crore registered users in India, online gaming intermediaries with at least 50 lakh users, and social media intermediaries with at least 2 crore users must erase after three years from the principal last approaching them or the Rules commencing, whichever is later, with at least 48 hours’ prior notice. Traffic data and logs must be kept for at least one year.

Retention clock for a Third Schedule entity

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Setting your own periods (rule 8 and the third schedule)

Data	Suggested approach
Customer orders	Legal period for tax, then delete
Marketing data	Until consent withdrawn
Rejected CVs	Delete soon after hiring
Support tickets	Fixed period after closing

Worked example

A small firm sets 7 years for invoices because of tax law and 6 months for rejected CVs. Both are recorded in a schedule.

Activity (5 minutes) (rule 8 and the third schedule)

Use the checker in How to set retention and erasure and write your schedule.

Key takeaway: Retention periods must have a reason. Write the reason beside each period.

Check your understanding of rule 8 and the third schedule

Q1. Third Schedule retention period after last approach:

Q2. Warning before erasure:

Q3. Logs must be kept at least:

← Accuracy and completeness Contact point and grievance mechanism →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for rule 8 and the third schedule: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.