DPDP data retention and erasure: build the lifecycle

Start with purpose completion

Section 8(7) connects erasure to the specified purpose no longer being served and retention no longer being necessary for compliance with law. Teams therefore need an operational event—such as account closure, delivery completion or the end of a support case—that systems can recognise.

Do not turn one schedule into a universal DPDP period. Different data may remain necessary for a continuing service, a legal obligation, security evidence or another documented purpose. Record the reason and the system of record for each exception.

• Name the purpose and the event that completes it.
• Identify each production system, processor, backup and export.
• Record the legal authority and expiry date for every retention override.

Model the Rules without flattening them

Rule 8 creates specific inactivity-based erasure periods for the classes and purposes listed in its Third Schedule. For those cases, the Data Principal must receive notice at least forty-eight hours before the period completes unless renewed activity or an exercise of rights changes the position.

The same rule also prescribes a minimum one-year period for specified processing records and logs, followed by erasure unless another law or Government notification requires longer retention. These provisions are scheduled to commence on 13 May 2027, so readiness work should preserve the distinction between current and future duties.

Make deletion testable across processors

A deletion request is incomplete if the primary database changes while search indexes, analytics stores, support attachments or processors keep active copies. Define deletion states, retry behaviour, processor acknowledgements and the treatment of immutable backups.

Test a sample record from trigger to completion. The evidence should show the governing rule, systems reached, exceptions applied, processor responses and final status without retaining the personal data merely to prove that it was erased.

• Use machine-readable retention classes rather than free-text notes.
• Alert when a processor misses its deletion service level.
• Reconcile legal holds and delete promptly when they expire.