DPDP reference

Rule 8: Time period for specified purpose to be deemed as no longer being served

Last checked 6 Nov 2026

Third Schedule classes must erase personal data after three years without the Data Principal approaching them or exercising her rights, unless a law requires retention (Rule 8(1)). The classes are online shopping entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh. Access to the user account and to stored virtual tokens is carved out.

At least forty eight hours before erasure the Data Fiduciary tells the Data Principal it will happen unless she logs in or makes contact (Rule 8(2)). Every Data Fiduciary retains personal data, traffic data and processing logs for at least one year from the processing, for the purposes in the Seventh Schedule, and then erases them unless another law requires more (Rule 8(3)).

Applies to
Rule 8(1) and Rule 8(2): the classes in the Third Schedule. Rule 8(3): every Data Fiduciary.
Starts
13 May 2027 (Rule 1(4)).
Penalty
Up to ₹50 crore (s.33, Schedule item 7).
Source
G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 8; G.S.R. 892(E), corrigenda

Questions

Is there a minimum retention period under the DPDP Rules?

Yes. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from the date of processing.

Does a deleted account remove the one year duty?

No. The Rule's first illustration keeps order details and logs for at least one year even if the buyer deletes her account.

Related

Next

Join early access

Not legal advice.