The General Obligation
LawSection 8(7) requires a Data Fiduciary to erase personal data once it's reasonable to assume the specified purpose is no longer being served, or once the Data Principal withdraws consent — whichever comes first — unless retention is otherwise required by law (a tax record retention requirement, for instance). Section 8(8) clarifies that a purpose is deemed no longer served once the Data Principal hasn't approached the Fiduciary for that purpose, or exercised any related right, for a period to be prescribed. This is the baseline obligation that applies to every Data Fiduciary, regardless of size or sector.
Retention Periods
PracticeOutside of the specific large-platform rule below, DPDP doesn't hand every business a fixed number of years to retain data for. The practical task is setting your own purpose-based retention period per data category — how long do you genuinely need this data to serve the purpose it was collected for, plus any independent legal retention requirement (financial records, employment records) that applies on top.
The Specific Rule for Large Platforms
LawThe DPDP Rules include a more specific erasure requirement in their Third Schedule, applying only to Data Fiduciaries above stated scale thresholds:
| Category | Threshold |
|---|---|
| E-commerce platforms | 2 crore+ registered users in India |
| Online gaming intermediaries | 50 lakh+ registered users |
| Social media intermediaries | 2 crore+ registered users |
For these specific categories, personal data must be erased after 3 years of user inactivity — measured from the Data Principal's last interaction for the relevant purpose, or from the Rules' commencement, whichever applies — with 48 hours' prior notice given before deletion actually takes place. If the Data Principal interacts with the platform again before the notice period lapses, the deletion doesn't proceed and the clock resets. Certain data needed to let the Data Principal access their own account, or specified virtual tokens, are excluded from this specific erasure requirement.
This summary of the Third Schedule follows a secondary-source analysis (cited below) rather than the Rules' primary text directly — verify the exact figures against the official Rules before relying on them for a specific compliance decision, particularly if your business is near one of these thresholds.
Assuming the 3-year figure is a universal DPDP retention period and applying it as a blanket policy. It's a specific rule for a narrow set of large platforms above stated thresholds — most businesses are governed by the general Section 8(7) obligation instead, which is purpose-based, not tied to a fixed 3-year figure.
Backup and Archived Data
PracticeAn erasure obligation that only covers the production database while identical data sits untouched in nightly backups for years isn't a genuine erasure practice. Backup and archive systems need their own retention and purge policy, ideally aligned with (or at least not wildly exceeding) the retention period set for the live system — a common approach is a rolling backup window (e.g., 30 or 90 days) after which older backups are themselves purged or overwritten.
Automated Deletion
TechnologyManually tracking retention deadlines per data category, per system, becomes unreliable quickly past a small scale. Automated deletion — a scheduled job that identifies and purges data past its retention period, or flags it for review — is where technology genuinely reduces risk here, turning a policy written in a document into something that actually happens on schedule rather than depending on someone remembering to run a manual cleanup.
Retention Schedules and Documentation
PracticeA retention schedule is simply a documented mapping of data category → retention period → justification (purpose-based, or a specific legal requirement) → deletion mechanism. Keeping this as a living document, reviewed whenever a new data category or purpose is introduced, is what makes an erasure request under Section 12 answerable in practice rather than a scramble across undocumented systems.