Data Retention

Data retention is the practice of keeping data only for as long as it is needed to fulfil a specified purpose, meet legal obligations or support legitimate business needs, and then securely deleting, anonymising or archiving it.

Data retention covers the policies, processes and controls an organisation uses to decide how long each type of data is stored and what happens when that time ends. The right period depends on the type of data, why it was collected, legal and regulatory requirements, contracts and operational needs.

Keeping data indefinitely creates risk. It raises storage costs, widens the attack surface, complicates data governance and makes audits, investigations and individual rights requests harder to handle. Modern retention programmes classify data, assign retention schedules, automate deletion and monitor compliance across systems.

What the DPDP Act and Rules say about data retention

The DPDP Act, 2023 sets the basic rule in Section 8(7). A Data Fiduciary must erase personal data when the Data Principal withdraws consent, or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless retention is necessary to comply with a law. It must also make its Data Processors erase the data.

The DPDP Rules, 2025 add detail in Rule 8:

• Inactivity erasure. Large platforms listed in the Third Schedule, such as e-commerce, online gaming and social media platforms, must erase personal data after a set period of user inactivity. For these platforms, the period is three years, counted from the last time the Data Principal approached them or exercised her rights. Three years is not a universal retention period.

• 48-hour notice. Before erasing data for inactivity, the platform must notify the Data Principal at least 48 hours in advance.

• One-year minimum for logs. Data Fiduciaries and their Data Processors must keep personal data, traffic data and processing logs for at least one year from the date of processing, for the purposes listed in the Seventh Schedule. These logs support breach investigation and breach containment. After one year, they must be erased unless another law requires longer retention.

The Rules were notified on 13 November 2025, and Rule 8 applies from 13 May 2027.

How data retention works in practice

1. Classify your data and map where it lives.

2. Set a retention period for each category, with the legal or business reason recorded.

3. Name an owner for each category.

4. Automate deletion or anonymisation when the period ends.

5. Include backups, archives, logs and Data Processors in the process.

6. Keep a record of what was deleted, when and why.

Data retention and related terms

• Data retention is the overall practice of deciding how long data is kept.

• A retention period is the specific time set for one category of data.

• Storage limitation is the principle that data should not be kept longer than needed.

• Data erasure is the act of deleting the data once the period ends or the purpose is served.

• Data minimisation means collecting less in the first place, which makes retention easier.

• A data retention policy is the document that records these rules.

In practice, gaps emerge when:

• Personal data is kept long after the original purpose has been served.

• Different business units apply different retention periods to similar data.

• Legacy applications keep storing personal data with no deletion policy.

• Backups and archives are left out of retention reviews.

• The organisation cannot show when or why personal data was deleted.

Organisations address these gaps with enterprise-wide retention schedules, data classification, automated deletion workflows and regular reviews of stored data.

How Privy supports data retention

Privy’s automated data discovery, data classification and data mapping help organisations find personal data across systems. Retention policy management, governance workflows and audit-ready reporting help them enforce retention periods and show when and why data was deleted.