How long can I keep personal data under DPDP?
The retention rule is simple to state and harder to live by.
Purpose-based, not arbitrary
Retention is tied to purpose, not habit. Marketing-consent data lasts until consent is withdrawn; transaction records may need to be kept for tax or accounting periods; support tickets only as long as needed to resolve and learn. Define a period for each category and justify it.
Reconcile with other laws
Several laws — tax, companies, labour, sector regulators — mandate minimum retention. DPDP's minimisation works alongside these: keep what the law requires for as long as it requires, and delete the rest. A retention schedule reconciles the two.
Make deletion real
A policy that says 'we delete when no longer needed' but never deletes anything fails. Implement deletion or anonymisation triggers, cover backups and processor copies, and keep evidence that deletion happened.
Frequently asked questions
Is there a fixed retention period under DPDP?
No. You set purpose-based periods per data category; the Act only requires you not to keep data longer than necessary.
What if another law requires me to keep data?
Then keep it for that statutory period. DPDP's minimisation applies to everything not legally required to be retained.
Does deletion include backups?
Yes, in principle. Your deletion process should account for backups and copies held by processors.
Set your retention periods
Use the Data Retention Period Calculator to map each data type to a defensible period.
Retention Period Calculator