Time period for specified purpose to be deemed as no longer being served
- Status
- Upcoming
- Applies from
- 13 May 2027Rule 1(4)
- Penalty
- Up to Rs 50 croreAct, Schedule, item 7
- Binds
- Every Data Fiduciary
In plain English
Three retention rules. First, the large platforms listed in the Third Schedule (e-commerce entities and social media intermediaries with two crore or more registered users in India, online gaming intermediaries with fifty lakh or more) must erase a person's personal data three years after they last approached the platform or exercised a right, or three years after the Rules commenced, whichever is latest, unless another law requires retention. Data needed to let the person into their account or to redeem a virtual token (a wallet balance, say) is excepted.
Second, at least 48 hours before that erasure, the platform must tell the person their data will be erased unless they log in, make contact or exercise a right. Third, and this applies to every Data Fiduciary: personal data, traffic data and processing logs must be kept for a minimum of one year from the processing, for the State purposes in the Seventh Schedule, and then erased unless another law or a Government notification requires longer. The illustration makes the point that this one-year minimum survives account deletion and binds your Data Processors.
What you must do
Set a one-year minimum retention for personal data, traffic data and processing logs, including at your Data Processors, and an erasure step at the end of it.
If you are in a Third Schedule class, build the three-year inactivity erasure and the 48-hour advance notice into the account lifecycle.
Reconcile these periods with sector rules (RBI, SEBI, Income-tax) that require longer retention, and document which law wins for each data set.
Note
The one-year minimum in sub-rule (3) pulls against the Act's s. 8(7) duty to erase once the purpose is served. The Rule resolves it: erase, but not before one year, and not before any longer period another law requires.
Gazette text · Rule 8A Data Fiduciary, who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule, shall erase such personal data, unless its retention is necessary for compliance with any law for the time being in force, or, for the corresponding time period specified in the Third Schedule, if the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing.
- (1)A Data Fiduciary, who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule, shall erase such personal data, unless its retention is necessary for compliance with any law for the time being in force, or, for the corresponding time period specified in the Third Schedule, if the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing.
- (2)At least forty-eight hours before completion of the time period for erasure of personal data under this rule, the Data Fiduciary shall inform the Data Principal that such personal data shall be erased upon completion of such period, unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose or exercises her rights in relation to the processing of such personal data.
- (3)Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government.
- Illustration. Case 1: X, a Data Principal purchases an e-book on an e-book platform Y. Once delivery is completed, the specified purpose of processing is served. The platform Y must retain the order details, personal data, and logs of the processing (such as order confirmation, payment, and delivery events) for at least one year from the date of the transaction, even if X deletes her account. Case 2: X, a company engages a cloud service provider C as its Data Processor to host customer records. X as the Data Fiduciary, is required to ensure that the C also retains the data and associated logs for at least one year before erasure, unless any other applicable law requires a longer period.
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)
Act sections and tools that apply
Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log