Under the DPDP Act, a business must erase personal data once the purpose is served or consent is withdrawn, unless a law requires retention. All businesses must keep personal data, traffic data and logs for at least one year for security and investigation purposes (Rules 6 and 8). Large e-commerce (2 crore+ users), online gaming (50 lakh+) and social media (2 crore+) platforms must erase data after 3 years of inactivity, with a 48-hour warning.
- General rule
- Erase when purpose served
- Logs
- Keep at least 1 year
- Large platforms
- Erase after 3 years of inactivity
- Warning before erasure
- 48 hours
Building a retention schedule
| Record | Typical period | Why |
|---|---|---|
| Enquiries that did not convert | 6–12 months | Purpose served; follow-up window |
| Customer invoices and accounts | 8 years | Companies Act, Section 128 (books of account) |
| GST records | 72 months from the due date of the annual return | CGST Act, Section 36 |
| Access and security logs | At least 1 year | DPDP Rule 6; CERT-In requires 180 days of ICT logs |
| Employee records after exit | As labour and tax laws require | Statutory registers, PF, tax |
Write the schedule down, automate deletion where you can, and make sure processors delete too.
Frequently asked questions
Can I keep customer data forever under DPDP?
No. Data must be erased once the purpose is served or consent is withdrawn, unless another law requires you to keep it.
Which law wins if another law requires longer retention?
The other law. The DPDP Act allows retention needed to comply with any law in force.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.