Rule 8: Time Period for Specified Purpose to Be Deemed as No Longer Being Served

Quick summary

What Rule 8 says

• A Data Fiduciary of a class specified in the Third Schedule must erase personal data once its retention period (also specified there) expires, unless the Data Principal has approached it or exercised her rights within that period, or unless retention is required by law.
• At least 48 hours before erasure, the Data Fiduciary must inform the Data Principal that her data will be erased on completion of the period, unless she logs in or otherwise initiates contact.
• Separately, a Data Fiduciary must retain personal data, traffic data and processing logs for a minimum of one year from the date of processing, for the purposes specified in the Seventh Schedule, then erase them — unless further retention is required by law or notified by the Government.

Breaking it down

This rule actually contains two different retention regimes, which is easy to conflate:

Regime 1: purpose-based erasure for specific classes of Data Fiduciary. Only companies in the classes the Third Schedule names — currently e-commerce entities with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh registered users in India, among other listed classes — face a specific retention clock: three years from the Data Principal's last interaction with her account, after which the data must be erased. This doesn't apply automatically to every Data Fiduciary; check the Third Schedule for the current list of classes and periods.

The 48-hour warning is a real operational requirement. Before erasing, the Data Fiduciary must tell the Data Principal — giving her the chance to log in or otherwise re-engage, which resets the clock. This means the erasure process has to be tied to a working notification system, not a silent background job.

Regime 2: one-year log retention, for everyone. Separately from the Third Schedule regime, every Data Fiduciary must retain processing logs (traffic data, records of processing activity) for a minimum of one year, specifically to support detection, investigation and remediation of security incidents — the same purpose the Seventh Schedule points to.

Why this rule matters

Retention policies that say “we keep data as long as necessary” without a concrete process behind them are exactly what Rule 8 is designed to close. For the Third Schedule classes especially, “as long as necessary” now has an actual number attached.

Real-world example

Who needs to care about this rule

• E-commerce and online gaming platforms specifically named in the Third Schedule — check whether your user-count thresholds apply.
• Data engineering teams building automated retention/erasure pipelines and the 48-hour warning notification.
• Security teams responsible for the separate one-year processing-log retention.

Common questions

Related rules