Think of the oldest folder on your company’s servers. Maybe it’s a 2018 campaign list, a few thousand abandoned sign-ups, or logs nobody has opened in years. For most businesses, that digital storage unit never got cleaned out because nobody was forced to.
From May 2027, the DPDP Rules start forcing the question: how long are you allowed to keep personal data, and when must you let it go?
The Rules That Seem to Pull in Opposite Directions
Most DPDP coverage is about consent and penalties. Retention gets less attention, yet it asks you to do two opposite things: keep some data for a minimum period, and delete other data on time. To manage both, you need to know exactly which data is which.
Rule One: Keep Certain Records for at Least a Year
Data Fiduciaries must retain personal data, traffic data, and processing logs for at least one year for the purposes in the Seventh Schedule, then erase them unless another law requires longer retention.
This links to security too. The Rules call for access logs to be kept for at least a year and for logs to be monitored and reviewed regularly. The logic is practical: if a breach happens, investigators need a trail. No logs means no answers, and that makes your position much worse.
Rule Two: Delete Inactive Data After Three Years (for Large Platforms)
Large platforms such as social media, gaming, and e-commerce services must delete inactive user data after three years and give 48 hours’ advance notice to affected users.
Note the scope. This rule applies to platforms that meet prescribed user thresholds, not every business. Check whether you qualify, and don’t assume you’re either covered or exempt.
Even if the three-year rule doesn’t apply to you, the idea behind it does. Once the purpose for collecting data is served, you shouldn’t keep it forever.
The Grey Area Nobody Talks About
What happens when a user asks you to delete their data, but the one-year retention requirement applies? Legal commentary points to a real tension here. Some analysis reads the final Rules as requiring one-year retention of data, traffic data, and logs even if the user deletes their account.
Other commentary describes the one-year retention as applying for specified purposes, after which erasure must follow. Interpretations are still evolving, so take this to a qualified lawyer, and make sure your privacy notice explains clearly what you keep, why, and for how long. Transparency is your best protection here.
Why This Matters More Than You Think
It cuts your risk. Old data you never needed is data you can still lose. A breach of records you should have deleted is a self-inflicted wound, and failing to maintain reasonable security safeguards can carry penalties of up to ₹250 crore under the Act.
It cuts your costs. Storing everything forever is expensive, and it gets more expensive as data grows.
It builds trust. Customers increasingly notice which companies respect their data, and which treat it as a permanent asset.
It’s harder than it sounds. Deleting a record from one database is easy. Deleting it from backups, analytics tools, email platforms, and vendor systems is not. That’s where compliance programmes often stumble.
Your Retention Checklist
- Inventory your data: list every category of personal data you hold and where it lives
- Assign a purpose and a period: every category needs a reason to exist and an end date
- Automate deletion: manual spreadsheets fail the first time someone is busy
- Build a 48-hour notice flow: needed if the three-year rule applies to you
- Protect and retain your logs: keep them secure and available for the minimum period
- Check vendors and backups: make sure deletion reaches every copy, including third parties
- Document everything: if the Board asks, “we meant to” is not evidence
Your Quick Win: The Data Diet
Don’t wait for the full programme. This month, find datasets nobody has touched in two years and make a call on each: delete, anonymise, or justify keeping. It takes a few hours and removes risk immediately. It’s the cheapest compliance step you can take, and it often reveals more forgotten data than teams expect.
The Bottom Line
The DPDP Rules turn data from something you collect and hold indefinitely into something you steward for a defined time. Companies that treat retention as a design principle, not a clean-up chore, will spend less, face fewer risks, and earn more trust.
With roughly six months to go, start with one decision: what data do you keep, and what’s overdue for goodbye?
Need help building retention and erasure workflows? Connect with Evvo Technology.
Not sure how much time you have left? Read DPDP Act 2027: Deadlines, Penalties & What to Do Right Now for the full timeline.
