Data Retention and Erasure Schedules That Actually Hold Up

A DPDP-ready data retention schedule tells you, for every category of personal data you hold, how long it stays and what triggers its deletion. Without one, "we'll deal with it later" becomes the default, and that default will not survive a Data Protection Board inquiry.

Key facts at a glance

• The Digital Personal Data Protection Act 2023 does not set one fixed retention number; data must be erased once its collection purpose is no longer being served.
• Full DPDP substantive obligations, including erasure rights, become enforceable 13 May 2027, with no stated grace period.
• Penalties for failing to implement reasonable security safeguards, which includes data left lying around indefinitely, can reach up to Rs 250 crore per instance.
• Sector-specific laws (tax, labour, company law) can require longer retention than DPDP's default "purpose served" rule, and those laws take precedence for that data.
• The Consent Manager registration framework under DPDP Rules 2025 becomes operational 13 November 2026.
• A retention schedule should cover data held by vendors and processors, not just data inside your own systems.

Why "keep everything forever" is no longer a safe default

Many small and mid-sized businesses accumulate customer, employee, and vendor data across email, spreadsheets, CRM tools, and old databases without ever deleting anything. That habit made sense when storage was cheap and no law penalised it. Under DPDP, indefinite retention without a documented reason becomes a liability rather than a convenience, because the law's default expectation is that data is erased once its purpose ends.

This does not mean panic-deleting records. It means building a schedule that says, clearly, why each category of data is kept and for how long, so that erasure happens on a predictable timeline instead of never.

Building the retention schedule

Step 1: Inventory your data categories

List every category of personal data you collect, such as customer contact details, order history, employee payroll records, job applicant resumes, and website visitor data. For each, note the source, the purpose of collection, and where it is stored.

Step 2: Assign a retention trigger and period

For each category, decide what event ends the purpose, such as "contract termination," "last transaction," or "employee exit," and how long after that event the data should be erased or anonymised. Where a specific law mandates a minimum retention period (for example, financial records under tax law), that period should override the default DPDP purpose-based rule.

Step 3: Automate or schedule deletion

Manual deletion is easy to forget. Wherever possible, configure systems to auto-purge or flag records for review once the retention period lapses, rather than relying on someone remembering months later.

Step 4: Extend the schedule to vendors

If a payroll processor, marketing agency, or IT vendor holds personal data on your behalf, your retention schedule should specify what they must do with that data once the engagement ends, ideally backed by a contractual clause requiring return or erasure.

Common categories and reasonable retention starting points

What "erasure" actually means in practice

Erasure does not always mean physically deleting a row from a database the same day. It can mean anonymising the data so it can no longer be linked back to an individual, provided the anonymisation is genuinely irreversible. Businesses should document which approach (deletion vs anonymisation) applies to which data category, since regulators and auditors will expect a clear, consistent answer rather than an ad hoc one.

Documenting the schedule for audit readiness

A retention schedule is only useful if it is written down and kept current. At minimum, document: the data categories, the legal or business basis for each retention period, the deletion trigger, and who is responsible for executing it. Review the schedule at least annually, and whenever a new system or data source is added to the business.

If you are not sure where your business stands on data retention and broader DPDP readiness, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology - meity.gov.in
• Data Protection Board of India (as constituted under DPDP) - meity.gov.in
• Income Tax Department, for tax-related record retention rules - incometax.gov.in
• Ministry of Corporate Affairs, for company record retention rules - mca.gov.in

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.