# DPDP Rules 2025, Rule 8: data retention and erasure periods

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-8-and-the-third-schedule-retention-and-erasure/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 8 and the Third Schedule, retention and erasure

- **Rule 8(1):** a Data Fiduciary of a class, processing for the corresponding purposes specified
  in the **Third Schedule**, shall **erase** the personal data once the specified period has
  elapsed since the Data Principal last approached it or exercised her rights, **unless retention
  is necessary for compliance with any law in force**.
- **Rule 8(2):** give the Data Principal notice **at least forty-eight hours before** completion of
  that period, so she can prevent erasure by approaching the Fiduciary or exercising a right.
- **Rule 8(3):** retain personal data, **associated traffic data and other logs** of the processing
  for a **minimum of one year** from the date of such processing.

**Third Schedule classes and periods** *(corroborated across sources; verify exact wording and
thresholds against the Gazette before quoting):*

| Class of Data Fiduciary | Period |
|---|---|
| **E-commerce entity** with not less than **two crore** registered users in India | **3 years** |
| **Online gaming intermediary** with not less than **fifty lakh** registered users in India | **3 years** |
| **Social media intermediary** with not less than **two crore** registered users in India | **3 years** |

The three-year clock runs from the Data Principal's **last approach** to the Fiduciary for the
specified purpose, or her last exercise of a right, whichever is later.

**Scope note:** the Third Schedule fixes a **deemed** expiry only for these classes and purposes.
For everyone else, s.8(7) still applies on its own terms: erase on withdrawal, or when it is
reasonable to assume the specified purpose is no longer served.