Rule 8 and the Third Schedule, retention and erasure

• Rule 8(1): a Data Fiduciary of a class, processing for the corresponding purposes specified in the Third Schedule, shall erase the personal data once the specified period has elapsed since the Data Principal last approached it or exercised her rights, unless retention is necessary for compliance with any law in force.
• Rule 8(2): give the Data Principal notice at least forty-eight hours before completion of that period, so she can prevent erasure by approaching the Fiduciary or exercising a right.
• Rule 8(3): retain personal data, associated traffic data and other logs of the processing for a minimum of one year from the date of such processing.

Third Schedule classes and periods (corroborated across sources; verify exact wording and thresholds against the Gazette before quoting):

Class of Data Fiduciary	Period
E-commerce entity with not less than two crore registered users in India	3 years
Online gaming intermediary with not less than fifty lakh registered users in India	3 years
Social media intermediary with not less than two crore registered users in India	3 years

The three-year clock runs from the Data Principal's last approach to the Fiduciary for the specified purpose, or her last exercise of a right, whichever is later.

Scope note: the Third Schedule fixes a deemed expiry only for these classes and purposes. For everyone else, s.8(7) still applies on its own terms: erase on withdrawal, or when it is reasonable to assume the specified purpose is no longer served.