Retention Period
The length of time personal data may be kept.
A retention period is the length of time you are allowed or required to keep a particular kind of personal data before you delete it. It is a number plus a start date, and it has to be justified.
Meaning of Retention Period
The Act requires erasure when the purpose is served or consent is withdrawn unless the law requires retention. Where no law fixes a period, the fiduciary should set a reasonable one and be able to justify it. Rule 8 sets specific periods for certain classes.
The DPDP Act does not give one universal period. Instead, Section 8(7) ties retention to purpose and to law: data must be erased once consent is withdrawn or the specified purpose is no longer served, unless retention is necessary for compliance with a law. So a retention period has two possible sources. One is a legal minimum set by another statute or regulator. The other is a business period that you set yourself as the time the purpose reasonably lasts.
Where the law fixes a period, it controls. Tax law governs invoices and books of account, company law governs statutory registers, regulators such as RBI, SEBI and IRDAI set periods for KYC, trading and policy records, and the CERT-In directions require logs to be held in India for 180 days. Rule 8 requires that certain logs and traffic data be retained for at least one year. For specified classes of e-commerce, online gaming and social media platforms above thresholds, the Third Schedule requires erasure three years after the person's last interaction, with a warning at least 48 hours earlier.
Where no law fixes a period, Section 8(8) and Section 8(11) shape the thinking: a purpose is treated as no longer served when the person has not approached the Fiduciary for it, or used any rights, for a prescribed period. Outside those prescribed classes, you set a reasonable period and document the reasoning. The period should reflect real needs, such as warranty claims, dispute limitation periods or fraud investigation windows, not simply habit.
A retention period is often confused with its neighbours. It is not an archive (storage for long-term legal or historical value), a backup cycle (recovery) or a legal hold (which temporarily suspends deletion). It also differs from storage limitation, which is the principle, and the data retention policy, which is the document containing the periods. And it only counts if you can trigger it: the start event, such as account closure, must be recorded.
Examples of Retention Period
Tax law requires a company to keep invoices for a set number of years, so a customer's erasure request does not remove those invoices.
A services company must keep invoices for the period set by tax law. When a customer asks it to delete their data, the company erases the profile and marketing data but keeps the invoices until the legal period ends, then deletes them.
A job portal keeps candidate profiles for as long as a candidate is active. After a stated inactivity period it sends a reminder and, if the candidate does not respond, removes the profile and resume files.
An insurance intermediary keeps policy-related documents for the period its regulator's rules require, plus a period for claim disputes, and it records both in its schedule with the relevant circular reference.
Why Retention Period matters
Too long a period expands your risk: more stored data means larger breach exposure, more rights requests and a weaker answer to the Board when asked why you still hold it. Too short a period can also hurt, if you delete data you must keep and then cannot answer a tax authority, regulator or court. Penalties on the wrong side run up to ₹50 crore for breach of the Act's general obligations.
A clear period also protects individuals. People can be told how long you will keep their data in the notice, and they can rely on it. That predictability is part of building trust and of showing that consent was informed.
How it works in practice
- 1List each record type and ask three questions: what is the purpose, what law applies, and what is the longest realistic time we will need it? The answers give the period.
- 2Define the trigger. Write the exact event that starts the clock, such as the date of the last transaction, the end of employment or the closure of a loan account.
- 3Record the reasoning next to the number. A short note such as "limitation period for contract claims" is enough to defend the choice later.
- 4Communicate the period. State it, or the criteria used, in the itemised notice so people know what to expect.
- 5Schedule the end-of-period action: delete, anonymise or archive with restricted access, and make sure processors follow the same date.
- 6Review periods yearly, and whenever a law, a product or a purpose changes.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Applying a legal minimum to all data of the same customer. An invoice may need to be kept, but the browsing history around it may not.
Picking a period with no trigger or end action. A number without a start date or a delete job is not enforceable.
Assuming the Rule 8 three-year figure is a safe period for everyone. It covers defined classes, and other entities should set periods based on purpose.
Forgetting that a longer period needs a reason. "Indefinite" is rarely defensible.
Compliance tips
Where two periods compete, keep each record only for the longer period that really applies to it, and delete the rest earlier.
Check sector rules before deleting regulated data, and note the circular or section that supports each period.
Reflect the final period in your notice and in your vendor contracts.
Make periods visible in your systems, for example with an expiry date field on each record or a lifecycle rule on each storage bucket.
Common questions about Retention Period
What is the retention period under the DPDP Act?
There is no single period. Data must be erased when consent is withdrawn or the purpose is no longer served, unless a law requires keeping it. Rule 8 sets specific periods for logs and for certain platform classes, and others set their own justified period.
Can I keep data after a customer asks for erasure?
Only if retention is necessary for the specified purpose or for compliance with a law, as Section 12(3) allows. Examples include invoices that tax law requires. You should delete what is not covered and tell the person what you are keeping and why.
How long must logs be kept?
Rule 8 requires certain logs and traffic data to be retained for at least one year, and the CERT-In directions require 180 days of logs to be kept in India. The longer applicable requirement governs, so check which rules apply to your service.
Is a retention period the same as storage limitation?
No. Storage limitation is the principle that data should not be kept longer than needed. A retention period is the concrete time limit you set or inherit for one category of data in order to apply that principle.