Under India's Digital Personal Data Protection (DPDP) Act 2023, businesses must erase personal data once its collection purpose is fulfilled — or once the Data Principal withdraws consent. Holding data beyond its useful life is no longer a passive risk; it is a statutory violation. This guide covers the storage-limitation and purpose-limitation principles, the right to erasure, how to build a data retention schedule, how to reconcile DPDP with sectoral laws, and the steps an Indian SMB must take to comply.
What DPDP Says About Storage Limitation
The DPDP Act 2023, notified by MeitY, establishes two intertwined obligations for every Data Fiduciary:
Purpose limitation: Personal data may be processed only for the specific, lawful purpose for which it was collected and for which consent (or a valid deemed-consent ground) was obtained.
Storage limitation: Once that purpose is no longer being served — because it is complete, consent has been withdrawn, or the account has been inactive beyond a threshold — the data must be erased. The Act does not permit indefinite retention "just in case."
One carve-out exists: if a law currently in force requires retention for a specific period, the fiduciary must retain for exactly that period — no longer. Reconciling DPDP deletion duties with sectoral retention mandates is the single most complex practical challenge for Indian businesses.
The Data Principal's Right to Erasure
The DPDP Act grants Data Principals — your users, customers, employees — the right to withdraw consent. Upon withdrawal, the Data Fiduciary must cease processing and erase the data, subject only to mandatory legal retention obligations. The Act also provides a right to request correction and erasure of personal data (FLAGS: VERIFY exact section number once Rules are notified).
This is not a soft right. A Data Principal whose erasure request is ignored has a path to the Data Protection Board of India (DPBI), which can levy penalties after inquiry. MeitY has signalled a penalty regime substantial enough to deter non-compliance at enterprise scale — the magnitude runs into multiple crores for safeguarding failures.
The practical implication: every product that collects personal data needs a functional erasure workflow, not a checkbox that silently does nothing.
Why Over-Retention Is a Breach Amplifier
Data you do not need is data that can be stolen. Regulators and courts have consistently held that retaining excess data is itself a security failure — not merely a compliance failure.
Consider a fintech that retains KYC scans indefinitely because "the auditors might ask." When that storage is compromised, they have exposed Aadhaar copies and PAN cards that should have been deleted years earlier. Under DPDP, this creates dual liability: the breach itself, and the over-retention that magnified its scope.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanBuilding a Data Retention Schedule
A retention schedule maps every category of personal data to its retention period, legal basis, and deletion trigger. It is the operational backbone of DPDP storage-limitation compliance.
Step 1 — Data Mapping
List every category of personal data you collect, where it is stored (database, backups, third-party processors, logs), who can access it, the legal basis for collection, and the specific documented purpose. You cannot schedule deletion for data you have not catalogued.
Step 2 — Assign Retention Periods
Retention periods must be grounded in either the operational purpose or a legal requirement. Where no legal minimum applies, the shortest period consistent with the business purpose is the right default.
Example Retention Schedule (Illustrative)
| Data Category | Typical Retention Basis | Trigger for Deletion |
|---|---|---|
| KYC / identity documents | RBI / PMLA (5–10 years) | Account closure + mandatory period elapsed |
| Payment transaction records | RBI PSP guidelines (up to 5 years) | Transaction settled + mandatory period elapsed |
| User account profile data | Duration of account + 90 days post-closure | Account deletion request or inactivity threshold |
| Marketing preferences and campaign data | Consent active | Consent withdrawn or campaign objective met |
| Customer support tickets | Reasonable operational window (12–24 months) | Issue resolved + window elapsed |
| Application / server logs | Security / incident investigation (6–12 months) | Log rotation policy elapsed |
| Employee HR records | Companies Act, Income Tax Act (varies, typically 8 years) | Statutory period after separation |
| Website cookies and analytics | Consent active | Consent withdrawn or session end (session cookies) |
Step 3 — Implement Automated Deletion
A schedule on paper is not compliance. You need scheduled jobs that delete records past their retention date, backup hygiene procedures (deleted live records must also be removed from backups or cryptographically segregated), log purge policies aligned to your schedule, and Data Processing Agreements that bind third-party processors to the same deletion timelines.
Secure Deletion: Logical vs Cryptographic Erasure
Not all deletion is equal. A DELETE SQL statement typically marks rows as deleted but does not overwrite underlying storage. For sensitive personal data, choose the right method:
Logical deletion marks data as deleted in the application layer but bytes may persist on disk until overwritten. Acceptable for low-sensitivity operational data where backup cycles eventually overwrite the blocks.
Cryptographic erasure encrypts data with a unique key per record. When the retention period ends, the key is destroyed — the data becomes inaccessible even if physical blocks persist. This is the recommended approach for biometrics, health data, and financial records in cloud environments.
Backups and third-party processors are the most overlooked vector. Organisations delete live data but leave the same record in daily backups, audit logs, and data-warehouse snapshots. Your deletion process must cover backup sweeps or key destruction, and Data Processing Agreements must bind processors to the same timelines. "We deleted it from our DB" is not sufficient if the data persists with a vendor.
Data Lifecycle and Retention Decision Flow
Reconciling DPDP Deletion with Sectoral Retention Laws
This is the most nuanced area of DPDP compliance. Multiple sector-specific laws impose mandatory minimum retention periods that may exceed what DPDP's storage-limitation principle would prefer.
Key sectoral mandates (illustrative — always verify with your legal counsel):
- PMLA 2002 and RBI KYC Master Direction: Financial intermediaries must retain KYC records and transaction records for a prescribed period after the business relationship ends.
- Companies Act 2013: Certain books of account must be retained for a minimum period after the relevant financial year.
- Income Tax Act 1961: Financial records must be retained for a period sufficient to cover potential scrutiny windows.
- IT Act 2000 and CERT-In Directions 2022: Logs and incident records must be retained for a minimum period. (Commonly cited as 180 days for CERT-In — FLAGS: VERIFY specific period against current Directions.)
Data Retention Periods by Category — Relative Overview
Practical Steps for an Indian SMB
Compliance does not require a large legal team. A focused action plan:
| Step | Action | Owner | Timeline |
|---|---|---|---|
| 1 | Complete a data-flow map covering all systems | CTO / DPO | Week 1–2 |
| 2 | Draft a Data Retention Schedule with legal citations | Legal + CTO | Week 2–4 |
| 3 | Implement automated deletion jobs per schedule | Engineering | Month 2 |
| 4 | Add erasure workflow to user account settings | Engineering | Month 2 |
| 5 | Update DPAs with all third-party processors | Legal | Month 2–3 |
| 6 | Add backup sweep / cryptographic erasure to deletion flow | Engineering | Month 3 |
| 7 | Train staff on retention obligations and escalation path | HR / DPO | Month 3 |
| 8 | Quarterly review of schedule against any new laws | DPO | Ongoing |
Security Infrastructure and DPDP Compliance
Good data security and DPDP compliance share the same technical foundation: encryption-at-rest underpins cryptographic erasure, access-control logging falls within your retention scope, and vulnerability management reduces the risk that over-retained data is exposed — mutually reinforcing, not separate workstreams.
Bachao.AI — built by Dhisattva AI Pvt Ltd — provides automated VAPT scanning that surfaces misconfigurations in storage systems, access controls, and logging infrastructure. A free VAPT scan is the right starting point before finalising your retention controls.
For the full framework — consent management, privacy notices, and grievance workflows — see our DPDP compliance guide.
Authoritative Sources:
- MeitY DPDP Act 2023: https://www.meity.gov.in/data-protection-framework
- DSCI Data Protection Resources: https://www.dsci.in/data-protection