The DPDP Rules 2025 pull in two directions. Section 8(7) of the Act asks for erasure once the purpose is served, while rules 6 and 8 ask for personal data, traffic data and processing logs to be kept at least one year. The rules' own illustrations say that floor applies even if the user deletes the account.
The two duties
Erasure: section 8(7) of the Act says a Data Fiduciary must erase personal data when the Data Principal withdraws consent or as soon as it is reasonable to assume the purpose is no longer served, unless a law requires retention. It must also cause its Data Processor to erase the data. Rule 8(1) and the Third Schedule give specific time periods for certain classes of fiduciary, and rule 8(2) asks for a warning to the user at least forty-eight hours before that erasure.
Retention: rule 8(3) says a Data Fiduciary must retain personal data, associated traffic data and other logs of the processing for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, then erase them unless another law requires more. Rule 6(1)(e) also refers to retaining logs and personal data for one year to support detection, investigation and recovery.
How the rules reconcile them
The illustrations under rule 8 help. In the first, a user buys an e-book and then deletes the account. The platform still must keep order details, personal data and logs of the processing, such as order confirmation, payment and delivery events, for at least one year from the transaction. In the second, a company using a cloud provider as Processor must make sure the provider also retains the data and logs for at least one year before erasure.
So the practical reading is erase when the purpose ends, but hold the processing record for the one year minimum, then erase.
What to design
- Separate the live profile from the processing record. A deleted account should remove the profile and active use, while the retained record is access restricted.
- Put retained records on a timer, so erasure after the minimum happens by default.
- Tag every log and record with a processing date, since the one year runs from that date.
- Restrict who can read retained data, and log reads.
- Check processors, because the rule expects retention and erasure to cascade.
- Look for longer periods in other laws, such as the CERT-In 180 day rule, or sector rules.
Do not guess the Seventh Schedule
The purposes in the Seventh Schedule bound what the retained data may be used for. Read them with counsel before you finalise a design, since they limit secondary use.
Quick check
If a user deletes their account, do we have to delete everything the same day?
Not by the text of rule 8(3) and its illustrations: the processing record is kept for a minimum of one year. The live profile and other data are a separate question under section 8(7).
When do these rules apply?
Rules 6 and 8 sit in the eighteen month group in rule 1(4). See the timeline post.
Sources
- Digital Personal Data Protection Rules, 2025 (MeitY)
- Digital Personal Data Protection Act, 2023 (MeitY)
Last reviewed: 19 October 2026.
