How Long Must You Keep It? Retention Laws Override The Delete Default
Under the DPDPA, deletion is the default. But record-keeping laws require many business records to be kept for years. Keep each record for the longest period that applies, and only then erase.
Prepared by Shubhank Suman, AI, Privacy, and IP Counsel
Read This First - Not Everything Is Deleted At One Year
"Not every kind of personal data must be erased within one year. The one-year period in the DPDP Rules (Rule 8(3) and Rule 6(1)(e)) runs from the date of last processing and is a minimum retention floor for personal data, traffic data, and logs, not a deadline to delete everything. Equally, the DPDPA's erase-on-purpose and erase-on-withdrawal triggers give way wherever another law requires the record to be kept longer.
Section 8(7) carves this out itself: the duty to erase applies unless retention is necessary for compliance with any law in force, and s.17(1)(a) preserves data needed to enforce a legal right or claim. So employee, tax, GST, financial, and vendor records must lawfully be kept for several years, as the table below shows."
Direct Statutory Retention Schedule
| Record / class | Law and direct legal basis | Retention | Clock / extension |
|---|---|---|---|
| DPDP one-year floor | DPDP Rules 2025 - Rule 8(3). Personal data, associated traffic data and processing logs retained for specified purposes. | Minimum 1 year | From date of processing; floor, not universal deletion deadline. |
| Large-platform inactivity | DPDP Rules 2025 - Rule 8(1), Rule 8(2), Third Schedule. Specified large e-commerce, social media and online gaming intermediaries. | 3 years | From prescribed inactivity point; 48 hours advance notice before erasure; longer statutory retention prevails. |
| PMLA transaction records | PMLA, 2002 - Section 12(3). Reporting-entity transaction records under Section 12(1)(a). | 5 years | From date of transaction between client and reporting entity. |
| PMLA KYC and client files | PMLA, 2002 - Section 12(4). Client identity, beneficial-owner documents, account files and business correspondence. | 5 years | After relationship ends or account closes, whichever is later. |
| SEBI listed-entity records | SEBI LODR Regulations, 2015 - Regulation 9. Board-approved preservation policy. | Permanent / at least 8 years | Permanent category, or at least 8 years after completion of relevant transaction. |
| Company books and vouchers | Companies Act, 2013 - Section 128(5). Books of account and vouchers relevant to entries. | At least 8 FYs | For 8 financial years immediately preceding a FY; longer if Central Government directs during investigation. |
| GST accounts and invoices | CGST Act, 2017 - Section 36. Records required under Section 35, including accounts, invoices, returns and GST records. | 72 months | From annual return due date; if proceedings/investigation apply, 1 year after final disposal or 72 months, whichever later. |
| Income-tax Rule 6F records | Income-tax Rules, 1962 - Rule 6F(5). Books/documents covered by Rule 6F for specified professions. | 6 years | From end of relevant AY; reopened-assessment records until reopened assessment is completed. |
| ESI employee register | Employees State Insurance (General) Regulations, 1950 - Regulation 32(2). Employee register. | 5 years | From date of last entry. |
| ESI accident book | Employees State Insurance (General) Regulations, 1950 - Regulation 66(ii). Accident book. | 5 years | From date of last entry in completed accident book. |
Rule of thumb: the longer statutory period always prevails over the DPDP one-year floor and erase-on-purpose trigger.
Data Deletion - The Erasure Obligation
When And How Data Must Be Erased
When no law requires longer retention, deletion is mandatory. The Data Fiduciary must erase its own copies and cause its Processor to erase the data made available for processing.
Prepared by Shubhank Suman, AI, Privacy, and IP Counsel
Core Legal Duties
| Duty | Legal basis |
|---|---|
| Erase trigger | DPDPA Section 8(7): erase when consent is withdrawn or purpose is no longer served, whichever is earlier, unless retention is necessary for compliance with law. |
| Processor erasure | DPDPA Section 8(7): cause the Processor to erase personal data made available by the Fiduciary. |
| Withdrawal of consent | DPDPA Section 6(6): cease processing within a reasonable time and make the Processor cease processing. |
| Legal-right exception | DPDPA Section 17(1)(a): processing needed to enforce a legal right or claim is preserved. |
Deletion Decision Flow
| Step | Question | Action |
|---|---|---|
| 1 | Trigger occurs | Consent withdrawn, purpose served, or prescribed inactivity period reached. |
| 2 | Check legal retention | Does any law, regulator direction, tax/GST audit, claim, proceeding, investigation or legal hold require longer retention? |
| 3A | If yes - retain | Retain only for the longest applicable legal period. Restrict access and document the legal basis. |
| 3B | If no - erase | Erase active systems, archives, backups, logs where applicable, caches, analytics stores, AI training sets and Processor/sub-processor copies. |
| 4 | Evidence deletion | Record completion without creating a new unnecessary personal-data store. |
Keep it at least one year - but do not treat one year as a universal deletion deadline.
Rule 8(3) creates a minimum one-year floor for personal data, associated traffic data and processing logs for specified purposes. Rule 6(1)(e) supports retention of logs/personal data for breach detection and investigation. These do not cancel longer record-retention duties under other laws.
Penalty note: failure to take reasonable security safeguards under DPDPA Section 8(5) may attract a penalty up to INR 250 crore under the penalty schedule.