Deleting personal data too early could violate India’s DPDP Rules.
Under the Digital Personal Data Protection (DPDP) Act, organisations must generally erase personal data when consent is withdrawn or the specified purpose is no longer served, unless retention is legally required.
But Rule 8(3) of the Digital Personal Data Protection Rules, 2025 introduces an important requirement.
The one-year minimum
Organisations must retain relevant personal data, associated traffic data and processing logs for at least one year from the date of processing, for specified statutory purposes.
An example from the Rules
Here’s an example taken from the Rules themselves.
A customer buys an e-book and then deletes their account.
Even though the transaction is complete and the account is deleted, the platform must retain the relevant order details, personal data and processing logs for at least one year.
After the year
After the required period, the data must be erased unless further retention is legally required.
The takeaway: Data protection compliance requires knowing exactly when personal data must be deleted and when the law requires it to be retained.
This article is general information, not legal advice.