Retention and transfers
How long can I keep personal data?
- Short answer
- Only as long as the specified purpose needs it, or as long as a law requires you to keep it. When consent is withdrawn or the purpose is served, whichever is earlier, you must erase it and cause your processors to erase it too.
There is no fixed period in the Act for most data, because the period follows the purpose. That is why a documented retention schedule per record type is the practical answer rather than a single global rule.
For certain notified classes of Data Fiduciary the Rules add a specific rule: erase three years after the Data Principal last approached you for the purpose or last exercised their rights, whichever is later, after giving at least forty eight hours notice.
Erasure includes anonymising to the point where the individual can no longer be identified by any means reasonably likely to be used. Keeping data because it might be useful later is not a purpose.
Where this comes from
- Section 8(7), DPDP Act 2023
- Rule 8 and the Third Schedule, DPDP Rules 2025
The mistake people make
Writing as long as necessary in a policy and never defining what that means for any actual record type.