Chapter 7: Retention and Erasure

Purpose limits, statutory retention, and erasure

chapter · 2 min read · Updated 14-Feb-2026 · 7 of 14

Executive Summary

•Data shouldn't live forever. When the purpose is served (e.g., the loan is paid off, the account is closed), the data must be destroyed. No hoarding.

•Purpose and legal basis: Implement retention schedules that distinguish purpose completion, withdrawal, erasure requests, and retention required by law.
•The "Withdrawal" Trigger: If a user withdraws consent, you must stop processing and delete the data (unless a law requires you to keep it, like tax records).
•Downstream Erasure: If you shared it with processors, tell them to delete it too.
•Notified retention: Rule 8 includes specific periods and notices for covered classes and requires certain processing records and logs to be retained for at least one year for Seventh Schedule purposes.

•Digital Shredder: When you leave a service, your data shouldn't stay on their servers indefinitely.
•Security: Less data lying around means less data to be stolen in a hack.

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A retention policy automatically removes data when its stated purpose ends, while preserving only legally required records.

Incorrect

×A business keeps every customer record indefinitely simply because deleting it was never added to the process.

Details the procedures for erasing personal data when required.

Erasure triggers: When data must be deleted
Erasure execution: Apply deletion across systems and processors when the legal conditions are met
Advance notice: For classes covered by rule 8(1), notify the Data Principal at least 48 hours before the specified period ends
Exceptions: Legal retention requirements

Primary sources: sections 8 and 12 of the DPDP Act and rule 8 with the Third and Seventh Schedules.