Data Retention Policy: When Keeping Data Becomes a Risk
A retention and deletion policy linking purpose, statutory records, disputes, backups, logs, inactive accounts and vendors.
Keeping data forever feels safe until a breach exposes records that no team can justify or locate.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
The Act requires erasure when consent is withdrawn or purpose is no longer served unless retention is required by law.
Rule 8 creates future retention and erasure requirements for specified circumstances and includes a one-year processing-data and log requirement for stated purposes.
Tax, employment, banking, insurance, litigation and sector laws can require longer retention than a general privacy schedule.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- The Act requires erasure when consent is withdrawn or purpose is no longer served unless retention is required by law.
- Rule 8 creates future retention and erasure requirements for specified circumstances and includes a one-year processing-data and log requirement for stated purposes.
- Tax, employment, banking, insurance, litigation and sector laws can require longer retention than a general privacy schedule.
- Deletion must address production, archives, exports, processors and backup cycles without destroying legal holds.
The five-point review
| Check | What to examine |
|---|---|
| Record | Category and system. |
| Purpose | Current operational need. |
| Law | Mandatory minimum or limitation. |
| Trigger | Closure, transaction, exit or dispute. |
| Deletion | Method, backup and processor. |
Practical example
An e-commerce account is closed and the CRM profile deleted, but support tickets, invoices, analytics IDs and vendor exports remain indefinitely. The policy should distinguish tax records from data that no longer serves a purpose.
How to apply the framework
Build retention by record category rather than department. One customer appears in many systems with different legal periods.
Use specific legal holds with owner and release date instead of a blanket ‘possible litigation’ justification.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review record, purpose and law together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Inventory record categories.
- Map legal periods.
- Define trigger events.
- Automate deletion.
- Flow deletion to processors.
- Audit backups and holds.
Evidence to keep
- Retention schedule
- Legal basis register
- Deletion logs
- Processor certificates
- Legal holds
Warning signs
- ‘Retain as needed’ wording
- Backups never expire
- Marketing history kept forever
- Vendor deletion untested
- No hold release date
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.