DPDP Data Retention and Erasure: How Long Can Businesses Keep Personal Data?

Hero Summary

Under India's Digital Personal Data Protection (DPDP) Act, 2023, a data fiduciary may keep personal data only as long as it is needed for the purpose it was collected for, unless another law requires longer retention. Personal data should be erased when the individual withdraws consent or when it is reasonable to assume the purpose is no longer being served, whichever is earlier. Individuals can also ask for their data to be corrected or erased, and the Rules require responses to such requests within ninety days. This guide explains the principles and how to build a retention schedule and erasure process that can stand up to scrutiny.

Executive Summary

Storage limitation — keeping personal data no longer than necessary — is one of the seven principles on which the DPDP Act rests, alongside consent and transparency, purpose limitation, data minimisation, accuracy, security safeguards, and accountability. For most organizations the hard part is operational: personal data is spread across applications, databases, backups, analytics systems, and processors, and each copy needs a defined lifespan and a way to be deleted. This guide explains the legal principles, how retention periods are decided when other laws also apply, how to build a retention schedule, how to handle erasure requests, and where organizations commonly go wrong. Because the Rules add detailed provisions for specific categories of organizations and for log retention, readers should confirm the details that apply to them in the official text.

The storage limitation principle {#principle}

The DPDP Act's approach to retention follows from purpose limitation: personal data is collected for a specific, lawful purpose and should not be kept once that purpose has been served. The Government of India describes storage limitation as one of the seven core principles that guide every stage of processing. The practical consequence is that "keep everything indefinitely, in case we need it" is not a defensible retention policy for personal data. Each category of personal data needs a purpose and a defined retention period.

When personal data must be erased {#when-erase}

The Act requires a data fiduciary to erase personal data, and to cause any data processor that processed it on its behalf to erase it, when the individual withdraws consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier — unless retention is necessary for compliance with a law that applies. In plain terms, there are three triggers:

1. Consent is withdrawn and there is no other lawful basis to keep the data.
2. The purpose has ended — for example, an account is closed, an order is complete and the warranty period has passed, or a job application process has concluded.
3. The individual requests erasure and the conditions for the right are met.

Individuals' rights to correction and erasure {#rights}

The Act gives individuals the right to seek correction, completion, updating, and erasure of their personal data. According to the Government of India's explainer on the Rules, data fiduciaries must address requests relating to access, correction, updating, or erasure within a maximum of ninety days. The Rules also let an individual nominate another person to exercise these rights on their behalf, for example during illness. Because the response clock is fixed, organizations need a way to receive, verify, route, and track requests rather than handling them ad hoc.

When you may keep data longer {#exceptions}

Erasure is not absolute. Other laws and regulations may require records to be kept for a minimum period, and keeping data to meet those requirements is permitted where the law requires it. Examples of sources of mandatory retention include tax and accounting requirements, sector regulations for banks and financial institutions, and CERT-In's requirement to retain ICT system logs for 180 days. Where data must be kept for a legal reason, the sensible approach is to:

• keep only the data the legal requirement actually covers,
• restrict access to it and use it only for that purpose,
• record the legal basis and the retention period, and
• delete it when the obligation ends.

The Rules add further provisions on retention and erasure — including specific provisions for certain categories of data fiduciaries and a minimum retention period for certain logs and related data. Confirm the provisions that apply to your organization in the Gazette text of the DPDP Rules, 2025.

Building a retention schedule {#schedule}

A retention schedule is a table that says, for each category of personal data, how long it is kept and why. A practical structure:

Data category	Purpose	System(s) where it lives	Retention period	Legal or business basis	Disposal method
Customer account data	Providing the service	CRM, billing, application database	Duration of account plus a defined period	Contract; tax and accounting rules	Deletion or anonymization
Marketing contact data	Marketing communications with consent	Email platform, CRM	Until consent is withdrawn or an inactivity period elapses	Consent	Deletion
Job applicant data	Recruitment	HR system, email	A defined period after the process ends	Legitimate recruitment purpose	Deletion
Security and access logs	Security monitoring and legal compliance	Log platform, SIEM	As required by applicable law and policy	Legal obligation; security	Automated expiry

Steps to build one:

1. Inventory the personal data you hold and the systems and processors it passes through.
2. Define the purpose for each category and the lawful basis for processing it.
3. Identify legal and regulatory retention requirements that apply to each.
4. Set a retention period — the longer of the business need and any legal requirement, but no longer.
5. Decide how data will be disposed of — deletion, anonymization, or aggregation — and document it.
6. Assign an owner for each data category who is accountable for the schedule.
7. Review at least annually and whenever systems, purposes, or laws change.

Handling erasure requests {#requests}

1. Receive and log the request through a published channel, and record the date.
2. Verify identity so data is not deleted or disclosed on the request of an impostor.
3. Locate the data across systems, including backups, replicas, analytics stores, and data held by processors.
4. Decide what must be kept for a legal reason, and what can be erased.
5. Erase and instruct processors to erase, and confirm they have done so.
6. Respond to the individual within the required period, explaining what was done and, where data was kept, why.
7. Keep evidence of the request, the decision, and the erasure.

Common problems {#problems}

• No data inventory, so nobody knows where all the copies are.
• Backups and archives that keep deleted data for long periods with no plan for expiry.
• Processors and vendors that hold copies and have no contractual duty to delete.
• Purposes defined too broadly, which makes every retention period unlimited.
• Retention periods that exist only on paper and are not enforced in systems.
• No evidence of deletion, so the organization cannot show what it did.

When the obligations apply {#timing}

The DPDP Rules were notified on 14 November 2025 with an eighteen-month phased compliance period, which places most data fiduciary obligations around May 2027. Retention schedules and deletion processes take time to build and test across systems, so planning now is sensible. Confirm exact dates in the official notification. For related topics, see What Is DPDP?, Consent Management Under DPDP, and Data Breach Response Under DPDP.

How Threat ResQ fits {#threat-resq-fit}

• PrivacyIQ, Threat ResQ's privacy management platform, provides a data inventory covering data assets, processing activities, and data flows, plus privacy-requests handling and vendor governance alongside technical discovery and readiness views. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status, and it does not manage consent.
• getTRAC, Threat ResQ's compliance automation platform, automates evidence collection and control mapping across frameworks.
• Threat ResQ's Compliance Consulting service supports regulatory readiness.

FAQ {#faq}

How long can a business keep personal data under the DPDP Act? Only as long as needed for the purpose it was collected for, unless another law requires longer retention. Data should be erased when consent is withdrawn or when it is reasonable to assume the purpose is no longer being served, whichever is earlier.

Does the DPDP Act give individuals a right to have their data erased? Yes. Individuals can seek correction, completion, updating, and erasure of their personal data, and the Government of India's explainer on the Rules says fiduciaries must respond to such requests within a maximum of ninety days.

Can I keep personal data if a law requires me to? Yes. Where another law requires records to be retained, such as tax or sector regulation, you may keep the data that law covers for the required period. Restrict access, record the basis, and delete it when the obligation ends.

What is a data retention schedule? A table that sets out, for each category of personal data, its purpose, where it is held, how long it is kept, the legal or business basis for that period, and how it will be disposed of.

When do the DPDP retention and erasure obligations apply? The Rules, notified on 14 November 2025, provide an eighteen-month phased compliance period, which places most obligations around May 2027. Confirm exact dates in the official notification.