Data Retention and Erasure Under the DPDP Rules: The Three-Year Clock and How to Automate It
The DPDP Rules attach a hard erasure clock to specified classes of data fiduciary: three years of Data Principal inactivity and the data must go, with 48 hours’ notice before deletion. Most Indian companies have never deleted anything. Here is what the rule requires and how to build the machinery.
Section 8(7) of the DPDPA mandates that a Data Fiduciary must erase personal data as soon as the specified purpose is no longer being served, or upon withdrawal of consent, unless retention is required for compliance with any law in force (such as the 7-year GST invoicing mandate).
Furthermore, the DPDP Rules establish a strict inactivity window for large e-commerce, gaming, and social media fiduciaries: if a Data Principal has not approached the fiduciary for the performance of the specified purpose for three years, the fiduciary must notify the user at least 48 hours in advance before purging the account and personal records.
Need help implementing this under the DPDP Act 2023?
Talk to our legal advisors at Manoj Bhagat & Associates or estimate your annual compliance cost in 30 seconds.