DPDP does not require every record to be deleted as soon as someone asks. The result depends on whether the relevant Digital Personal Data Protection (DPDP) provision has commenced, the organisation’s role and class, the purpose and type of record, and whether another law requires retention. A valid legal-retention duty can preserve data that would otherwise be erased, but it must be identified and matched to the specific record.
As of 18 October 2026, the commencement dates in the Government of India’s 13 November 2025 notifications leave most substantive DPDP Act provisions and the Rules’ erasure provisions scheduled for 13 May 2027. That timetable may be changed by a later notification, so use the latest Gazette before making a date-specific compliance decision.
As an Amazon Associate I earn from qualifying purchases.
The short answer: deletion and retention duties must be reconciled
When a person asks an organisation to erase personal data, do not choose between “delete everything” and “keep everything.” First identify the operative DPDP provision, then map each record to its purpose, legal basis, system and owner. Finally, test whether another law or government notification requires that particular record to remain available.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The DPDP Rules, 2025 create two different mechanisms. Rule 8 uses a schedule-based erasure period for specified classes of Data Fiduciaries and purposes, with at least 48 hours’ notice before the applicable period ends. Rule 8(3) sets a minimum one-year period from processing for specified personal data, associated traffic data and other processing logs used for purposes listed in the Seventh Schedule; after that period, the Data Fiduciary must cause erasure unless another law or government notification requires continued retention. Neither mechanism is a universal retention or deletion period for every business record.
The Rules also preserve retention that is necessary to comply with a law in force. That is an exception to erasure, not a licence to retain data indefinitely. The organisation should be able to name the law or notification, the covered entity and record category, the retention trigger and start date, the end date or review event, permitted access, and the disposal action when the duty expires.
Which DPDP provisions are in force?
The 13 November 2025 commencement notification and the 13 November 2025 Rules Gazette use a phased timetable. “Notified” does not mean that every substantive obligation became operative on publication.
| Instrument | Provision group | Commencement stated in the notification | Position on 18 October 2026 |
|---|---|---|---|
| DPDP Act, 2023 | Specified institutional and enabling provisions | On publication of the commencement notification, 13 November 2025 | In force from publication, subject to the exact text of the notification |
| DPDP Act, 2023 | Section 6(9) and section 27(1)(d) | After one year from 13 November 2025 | Scheduled for 13 November 2026; not yet reached on the stated date |
| DPDP Act, 2023 | Most substantive provisions, including sections 3–17 | After eighteen months from 13 November 2025 | Scheduled for 13 May 2027, unless a later notification changes the date |
| DPDP Rules, 2025 | Rules 1, 2 and 17–21 | On publication of the Rules Gazette, 13 November 2025 | Operative from publication, subject to later amendment |
| DPDP Rules, 2025 | Rule 4 | After one year from 13 November 2025 | Scheduled for 13 November 2026 |
| DPDP Rules, 2025 | Rules 3, 5–16, 22 and 23 | After eighteen months from 13 November 2025 | Scheduled for 13 May 2027; Rule 8 falls in this group |
For a production decision, check the latest version of G.S.R. 843(E), the commencement notification under the DPDP Act, and G.S.R. 846(E), the Digital Personal Data Protection Rules, 2025. The Gazette text controls legal effect; a government press release is useful background but should not replace the notification when you calculate an effective date.
What Rule 8 would require when its provisions commence
Schedule-based erasure for specified fiduciaries and purposes
Rule 8 applies a prescribed erasure period to the classes of Data Fiduciaries and corresponding purposes identified in the Third Schedule. It is therefore necessary to verify both sides of the match: the organisation’s class and the purpose for which the data is processed. A general statement such as “all companies must delete after the Rule 8 period” is wrong.
The trigger can also depend on account activity or an exercise of rights by the Data Principal, according to the text. The operational team should record the event that starts the clock, rather than silently substituting the date on which a database row was created.
Forty-eight-hour advance notice
For an erasure under the applicable period, Rule 8(2) provides for notice at least 48 hours before completion of that period. Build the notice into the workflow with a time zone, delivery channel and audit record. A failed email, an undelivered message or a notice sent after the deadline can make an otherwise correct deletion process difficult to prove.
One-year minimum for a defined set of data and logs
Rule 8(3) covers personal data, associated traffic data and other processing logs for the purposes specified in the Seventh Schedule. The minimum is one year from processing. Once that minimum has elapsed, the Data Fiduciary is to cause erasure unless a law in force or a government notification requires further retention.
Free tools Windows power users keep installed
One-click scans. No signup required.
This clause does not say that every customer record, invoice, employee file or security log must be kept for one year. It is limited to the data, logs and purposes described in the Seventh Schedule. Conversely, the one-year floor does not permit an organisation to delete a record earlier when another applicable law requires a longer period.
How DPDP interacts with PMLA, IT and sectoral duties
DPDP and another retention rule generally operate together. The correct question is not “Which law wins?” but “What does each law require for this entity, record, purpose and time period?” The DPDP Rules’ legal-retention exception means that an applicable law can require continued retention. It does not identify every law that might apply, and it does not establish a universal PMLA or CERT-In period.
| Duty to compare | Questions to answer |
|---|---|
| Covered entity | Is the organisation a Data Fiduciary, a processor acting for one, a reporting entity, an intermediary, a regulated financial institution, an employer or another legally defined class? |
| Record category | Is the request about profile data, identity-verification material, transaction records, accounting evidence, communications, traffic data, security events, processing logs or a backup? |
| Purpose or trigger | Was the record collected for service delivery, fraud prevention, a statutory report, an investigation, security monitoring, a dispute, or another purpose? |
| Required period and start date | Does the clock begin at collection, processing, account closure, the transaction, the last activity, a report, an investigation or another event? |
| Permitted access while retained | Which staff, processors and investigators may access the retained copy, and what controls prevent reuse for unrelated purposes? |
| Disclosure or production | Must the record be available to a regulator, court, law-enforcement body or auditor, and through what controlled process? |
| Exception or legal hold | Is there a specific law, government notification or documented legal requirement that postpones deletion? |
| Disposal at expiry | What deletion, destruction or anonymisation action removes the record from live systems, replicas, exports and processor-held copies? |
PMLA retention
The material available for this guide does not establish the current PMLA record-keeping period from authoritative statutory text. Do not publish or implement a single number as a supposedly universal PMLA duration. Identify whether the organisation is within the relevant PMLA-defined class, identify the exact record and transaction, and verify the current Act, rules, notifications and regulator guidance before refusing an erasure request on that basis.
IT Act, CERT-In and security-log duties
The same caution applies to IT and CERT-In requirements. The applicable direction can depend on the entity, incident, service and type of log. The available evidence does not establish one current duration for every organisation. Confirm the operative direction and any sector-specific rule, then document why the particular log must be retained and who may use it.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Other sectoral requirements
Banking, insurance, securities, telecom, health, employment, tax, consumer-protection and litigation obligations can each address different records. Treat “sectoral retention” as a prompt to identify the actual rule, not as a blanket reason to keep an entire customer account. If the duty covers only a transaction record, isolate that record and delete unrelated profile data when the DPDP trigger is met.
A step-by-step process for an erasure request
- Freeze the facts and date. Record when the request arrived, the requester’s account or identifier, the systems searched, and the date on which you are assessing commencement. Recheck the latest commencement notification and Rules Gazette before applying a provision scheduled for a future date.
- Classify the organisation’s role. Decide whether the organisation is acting as Data Fiduciary or processor for this activity. If it is a processor, route the request and retention decision through the responsible Data Fiduciary and the contract’s deletion instructions.
- Check Rule 8 scope. Determine whether the organisation belongs to a Third Schedule class and whether the processing purpose is one listed there. Do not apply a schedule period merely because the data is personal.
- Map every copy and record type. Separate the data named in the request from identity-verification files, invoices, transaction evidence, security events, traffic data, processing logs, backups, exports and processor-held copies. A single “customer record” label hides different legal clocks.
- Identify the trigger and clock. Write down the event that starts each period and the calculated expiry date. For Rule 8(3), the stated minimum is one year from processing for the specified data and purposes; it is not one year from account creation for every record.
- Test a specific retention exception. Name the applicable law or government notification, the entity it covers, the record category, the required period and the reason the copy is still needed. If you cannot identify those elements, escalate rather than inventing a retention basis.
- Limit access during retention. Mark the retained record, restrict access to the people and systems that need it, prevent secondary use, and keep an audit trail of viewing, export and disclosure.
- Send any required notice. Where the applicable Rule 8 period requires it, send notice at least 48 hours before completion and preserve delivery evidence, including the time zone and channel.
- Delete what is no longer required. Erase or otherwise dispose of the data in live databases, search indexes, object storage, caches, exports, test environments and processor systems according to the operative requirement and contract.
- Close the record. Store the decision, legal references, dates, systems checked, exception rationale, approver and deletion evidence. Keep only the minimum audit information needed to demonstrate the decision, subject to its own retention analysis.
Use a record-level retention register
A retention register prevents a broad legal label from swallowing an entire database. Each row should represent a record category and purpose, not merely an application.
| Register field | Example entry format |
|---|---|
| Record category | Identity-verification image; payment transaction; fraud alert; access log |
| Data elements | List the fields and attachments, including associated traffic data or processing logs where relevant |
| Purpose | State the operational or statutory purpose in plain language |
| Responsible role | Data Fiduciary owner, processor, compliance owner and system owner |
| DPDP basis | Applicable Act or Rule provision and whether it is operative on the assessment date |
| Other-law basis | Exact Act, rule, notification or direction; entity and record scope |
| Clock | Trigger event, start date, minimum period, expiry or review date |
| Access | Approved roles, processor access, export controls and disclosure route |
| End action | Deletion, destruction, anonymisation or documented review, including replicas and backups |
| Evidence | Notice, approval, legal analysis, deletion log and exception review |
Worked examples
A former customer asks to delete an account
Separate the account profile from invoices, transaction evidence, identity-verification material and security records. Check whether Rule 8’s class-and-purpose schedule applies, whether the one-year clause covers any associated traffic data or processing logs, and whether a specific financial, tax, anti-money-laundering or dispute obligation covers another record. Delete the profile data that has no continuing basis while retaining only the narrowly scoped records that a verified law requires.
A security team wants to keep every log “just in case”
Classify the log, its purpose and the applicable direction. A generic security preference is not the same as a legal retention requirement. If a current CERT-In or sectoral direction applies, record its exact scope and clock; if not, apply the operative DPDP rule for the specified data and purpose and set an expiry workflow.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallA processor receives a deletion instruction
Confirm the controller-like Data Fiduciary’s instruction, search the processor’s primary store, replicas, support exports and subprocessors, and report exceptions record by record. A processor should not independently decide that a statutory exception applies without the responsible party’s documented legal determination.
Best Value
Common mistakes and how to correct them
- Treating publication as immediate operation. Correct the calendar by separating provisions effective on 13 November 2025 from those scheduled for 13 November 2026 or 13 May 2027.
- Using one retention period for the whole database. Replace the database-wide rule with record-and-purpose rows in a retention register.
- Claiming that DPDP overrides PMLA or IT duties. Identify the specific conflicting obligation and apply the Rules’ legal-retention exception only to the records it actually covers.
- Quoting an unverified PMLA or CERT-In number. Verify the current primary source for the entity and record before communicating a duration.
- Ignoring traffic data and logs. Check whether the Seventh Schedule scope includes the associated traffic data or processing logs for the stated purpose.
- Deleting the live row but retaining easy-to-search copies. Include indexes, analytics extracts, tickets, exports, backups and processor systems in the disposal design.
- Keeping retained data available to everyone. Apply role-based access, monitoring, purpose limitation and controlled disclosure while the legal period runs.
- Failing to preserve the decision trail. Keep the request, notice timing, legal basis, clock calculation, approver and deletion result in an auditable record.
Technical controls that make the decision enforceable
- Assign a retention policy identifier to each record category and propagate it through the application, warehouse, object store and backup catalogue.
- Store the trigger event and expiry timestamp separately from the creation timestamp so an account change or rights exercise can be evaluated correctly.
- Use a legal-hold or retention-exception flag only when it links to a named law, notification or documented proceeding; require an owner and review date.
- Make deletion jobs idempotent, report failures, and surface records that cannot be removed because of an immutable archive or backup cycle.
- Keep a minimal deletion ledger that proves what action occurred without recreating the personal data that was deleted.
- Test restoration procedures: a backup restored after deletion must not silently repopulate an expired record in the live environment.
- Contractually require processors and subprocessors to apply the same record-level instruction, report exceptions and certify completion.
When to escalate
Escalate to India-qualified privacy or regulatory counsel when the organisation’s status is unclear, a request involves a regulated financial or reporting activity, a regulator or law-enforcement request is pending, records are subject to litigation or investigation, or two primary sources appear to impose different clocks. A deletion tool can execute a decision; it cannot determine which law applies.
For each disputed request, ask counsel to confirm the covered entity, record category, purpose, commencement status, legal-retention basis, start date, end date, access limits and disposal method. Preserve the final written analysis with the request record.
Bottom line
DPDP erasure is a scoped, phased obligation, not an automatic command to destroy every record on request. The 2025 Rules provide a schedule-based erasure mechanism and a one-year minimum for specified data and logs, while allowing further retention required by another law or government notification. Because PMLA and CERT-In periods are entity- and record-specific and are not established here from authoritative text, verify those duties before relying on them. The compliant approach is a dated, record-level decision that deletes what no longer has a lawful purpose and retains only what a clearly identified rule still requires.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
