Data retention and erasure under the DPDP Act
Reviewed against the law as of 28 September 2026
When the DPDP Act requires erasure, how long data may be kept, the 48-hour notice for large platforms, logs, backups and processors.
Storage limitation is one of the principles behind the DPDP Act. Section 8(7) requires a Data Fiduciary to erase personal data, and make its processors erase it, when a person withdraws consent or as soon as it is reasonable to assume the specified purpose is no longer being served, unless retention is necessary to comply with a law.
When is the purpose no longer served?
Section 8(8) treats the purpose as no longer served if the Data Principal does not approach the Data Fiduciary for performance of the purpose, or exercise any of their rights, for a prescribed period. The Rules set such periods for specified classes of large platforms, such as major e-commerce, online gaming and social media intermediaries, and require the platform to inform the person at least 48 hours before erasure so they can log in or otherwise keep the account.
For everyone else, the test is the purpose itself. Decide and document how long each dataset is needed.
Laws that require longer retention
Other laws often set minimum periods: tax and accounting records, anti-money-laundering records for regulated entities, employment records, sector regulator requirements. Where they apply, keep only the data those laws require, restrict access, and erase when the period ends.
Logs are personal data too
Logs contain IP addresses, user identifiers and sometimes e-mail addresses. The Rules require personal data, associated traffic data and logs of processing to be kept for at least one year for detecting and investigating breaches, and CERT-In requires ICT logs for 180 days in India. After those periods, the same storage limitation applies. See log retention.
A retention plan that works
- Per dataset, record the purpose, the retention period, the legal basis for that period and the deletion mechanism.
- Automate deletion where possible: scheduled jobs, time-to-live settings, lifecycle rules on storage.
- Handle copies: replicas, analytics warehouses, exports, test environments restored from production.
- Handle backups: a defined rotation, encryption, no restore into live systems without re-applying deletions.
- Bind processors: deletion on instruction and at contract end, with confirmation.
- Test it: check that expired data is actually gone, and keep the evidence.
Common gaps
- No retention period at all for marketing leads and old customer accounts.
- Production data copied into test or staging systems and never removed.
- Customer exports in shared drives and storage buckets.
- Deletion in the application but not in the data warehouse.
TrustNiq flags datasets without a defined retention and deletion mechanism, finds personal data in non-production systems, and records minimisation decisions with due dates. See how it works.
Frequently asked questions
How long can we keep personal data under DPDP?
Only as long as needed for the specified purpose, or longer if another law requires it. For some large platforms the Rules set a period of inactivity after which data must be erased.
Do we have to delete data from backups?
The Act requires erasure once the purpose is served. For backups, a documented approach where data expires on a defined rotation, is not restored into live systems and is protected meanwhile is a common way to meet this.
Does erasure apply to our processors?
Yes. You must cause your Data Processors to erase personal data made available to them, and your contracts should require it and provide confirmation.
Sources
- Digital Personal Data Protection Act, 2023, section 8(7) and 8(8)meity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.