DPDP Glossary

Retention

Keeping personal data only as long as necessary for the specified purpose, unless retention is required by law, with Rule 8 addressing certain deemed time periods.

Section 8; Rule 8

What it means

Section 8 expects Fiduciaries not to retain personal data longer than needed for the specified purpose unless another law requires retention. Rule 8 adds Rules-layer timing detail for certain situations. Retention is purpose-driven with legal overrides — not “keep forever for analytics just in case.”

Worked example

Support chat transcripts kept indefinitely after the ticket purpose ends, with no legal hold, drift into unjustified retention. Tax or employment records retained because another statute requires it are a different, documentable case.

In practice

Publish retention schedules tied to purposes and legal holds. Automate deletion where possible. See Rule 8 for Rules-specific periods.

Rule 8: Retention & erasure →

Source

Section 8; Rule 8 · Official text (PDF)

Educational summary based on the Digital Personal Data Protection Act, 2023 and Rules, 2025. Not legal advice.

Further reading

ErasureRemoval of personal data when it is no longer necessary for the specified purpose, subject to legal retention requirements and Section 12 requests.PurposeThe lawful purpose for which personal data is processed; consent is purpose-linked and certain legitimate uses are also provided.Data FiduciaryAny person who alone or with others determines the purpose and means of processing of personal data.

← Back to glossary