Data Retention Policy
A written rule for how long each type of personal data is kept and when it is deleted.
A data retention policy is a written rule that says how long each kind of personal data is kept, why, and how it is deleted afterwards. It turns the duty to erase from an occasional clean-up into a routine process.
Meaning of Data Retention Policy
A policy sets periods by record type, based on legal requirements and real business need, and covers backups and vendors. It makes erasure routine instead of ad hoc.
The DPDP Act does not mandate a document by this name, yet Section 8(7) demands the outcome the policy produces. When consent is withdrawn or the specified purpose is no longer served, personal data must be erased, and processors must be made to erase it, unless the law requires retention. Without a written schedule, nobody can say which records are due for deletion, and the duty to erase is met only by accident.
A usable policy has a few parts. It defines scope: which systems, formats and entities. It lists record categories, for example customer profiles, KYC files, payment records, job applications, CCTV footage and support tickets. For each, it states a period, the trigger from which the period runs, the legal or business reason, the disposal method and the owner. It also covers exceptions such as legal holds, and the handling of backups, archives and data held by processors.
The numbers must come from somewhere. Some are set by other laws: tax and company law for financial records, RBI, SEBI and IRDAI rules for regulated entities, labour laws for employment records, and the CERT-In directions for logs. Rule 8 requires certain logs and traffic data to be kept for at least one year, and for specified e-commerce, gaming and social media classes it sets an erasure point after three years of inactivity with a prior 48-hour warning. Where no law applies, the business must pick a period it can justify by purpose.
A retention policy should be distinguished from a retention period (a single number) and from a data retention schedule (the table inside the policy). The policy is the governing document that sets principles, roles, process and the schedule, and describes what happens at the end. It also differs from a backup policy: backups exist for recovery, but they still contain personal data and need an expiry rule.
Examples of Data Retention Policy
A company keeps invoices for the legally required period, deletes unsuccessful job applications after the hiring cycle and removes inactive marketing contacts annually.
A manufacturing company keeps payroll and statutory records for the legally required period after an employee leaves. Interview notes for rejected candidates are deleted six months after the hiring round, and background check reports are removed once the offer is confirmed.
An e-commerce marketplace sets rules for order data, wishlists, customer chats and device logs. Customer chats are deleted after 12 months, invoices are archived for the tax period, and profiles of inactive users enter the warning workflow before the Rule 8 limit.
A diagnostic lab keeps reports for the period its clinical rules require, deletes appointment-booking data after a short interval and stores CCTV footage for a limited rolling period, with a documented hold for any incident under review.
Why Data Retention Policy matters
A written policy is the main evidence that erasure is a managed process. If the Board asks why a customer's records from ten years ago still exist, the answer should be a document that shows the reason and the review. Failure to erase when required can count under the general penalty head of up to ₹50 crore, and a large archive of old data increases breach impact, where security failures reach up to ₹250 crore.
Internally, a policy removes arguments. Teams know what to keep, what to delete and who decides, legal gets predictable evidence, and IT can plan storage and automation.
How it works in practice
- 1Get the right people in the room: legal, finance, HR, IT, security and the business owners of each record type. Each knows something about why records exist.
- 2Build the schedule from your data map. For each record category, record the trigger, period, basis and disposal method, and note the statute where one applies.
- 3Decide on disposal methods that match the medium: secure deletion or cryptographic erasure for digital data, shredding for paper that has been digitised, and certified wipe for devices.
- 4Cover processors and backups. Add retention and deletion clauses to vendor contracts and set a maximum backup retention that you can explain.
- 5Automate and log. Schedule purge jobs, require approval for exceptions and keep run logs as evidence.
- 6Train staff on what they may keep on laptops, mailboxes and shared drives, and audit compliance once a year.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Writing a policy with no triggers. "Keep for five years" means nothing unless you say five years from when.
Setting every period at the longest legal minimum. Apply the statutory period only to records that the statute covers.
Exempting backups and vendor copies from the policy, which leaves most of the data untouched.
Having a policy but no deletion jobs. A policy that is not run does not meet Section 8(7).
Compliance tips
Keep the schedule on one or two pages and put the reasoning beside each period. Short documents get read.
Name one owner per record category, and have them confirm the entries every year.
Add a legal hold procedure so that records tied to litigation or investigation are paused and later released in an orderly way.
Test the policy by selecting a random customer and checking that you can find and delete every copy.
Common questions about Data Retention Policy
Does the DPDP Act require a data retention policy?
It does not name one, but Section 8(7) requires erasure when purpose ends or consent is withdrawn. A written retention policy is the practical way to meet that duty and to show how you decided each period.
What should a data retention policy include?
Scope, record categories, retention periods with their triggers and reasons, legal references, disposal methods, handling of backups and processors, legal holds, roles and review dates. A table with an owner for each category is usually the heart of it.
How long should I keep personal data in India?
There is no single answer. It depends on purpose and on other laws, such as tax rules, sectoral regulator rules and Rule 8 for specified classes. Choose the shortest period you can justify and be ready to explain it.
Is a retention policy the same as a retention schedule?
Not exactly. The schedule is the table of record types and periods. The policy also covers principles, responsibilities, disposal methods, exceptions and review. Most organisations keep both in one document.