The general rule in section 8(7)
A Data Fiduciary must erase personal data, and cause its processors to erase it, when the Data Principal withdraws consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier. The exception is where retention is necessary to comply with a law in force.
A lender, for example, may need to keep loan records for periods set by RBI directions or tax law even after the loan is closed. Those records stay, limited to what the law needs. The marketing profile built for cross selling does not have the same cover.
When the purpose is deemed served
Section 8(8) says the purpose is deemed no longer served if the Data Principal does not approach the Data Fiduciary for the performance of the purpose, or exercise any of their rights, within a period that is prescribed. The Rules prescribe that period for certain classes of Data Fiduciaries.
The three year rule for large platforms
The Third Schedule to the Rules sets a period of three years for these classes, counted from when the Data Principal last approached the Data Fiduciary or exercised their rights, or from the commencement of the Rules, whichever is later.
- E-commerce entities with at least two crore registered users in India
- Social media intermediaries with at least two crore registered users in India
- Online gaming intermediaries with at least fifty lakh registered users in India
The 48 hour notice
Where the Rules set such a period, the Data Fiduciary must inform the Data Principal at least 48 hours before the data is erased that it will be erased unless they log in to their account or otherwise contact the Data Fiduciary. A large marketplace therefore needs a scheduled job that finds dormant accounts, sends the notice, waits, and then erases only where the person has not returned.
Erasure reaches your processors and backups
Erasing a record in your core database is only part of the work. The same data may sit in your CRM, a support tool, a marketing platform, a data warehouse and your vendors' systems. Section 8(7) makes it your duty to have processors erase it too, so contracts should say how they do it and how they confirm it.
A school that stops using a learning app should ask the vendor to confirm erasure of student records and keep that confirmation on file.
How TrustOS helps
TrustOS records a retention period and legal basis for each purpose, flags data held past its period, and runs erasure tasks across connected systems and processors with a record of each step. For classes under the Third Schedule, it can schedule the 48 hour notice before erasure.
TrustOS does not decide which laws require you to retain data, or for how long. Those periods come from your legal and compliance teams, and TrustOS does not replace legal advice.
Official sources
- MeitY: Data protection framework (the Act, the Rules and notifications)
- India Code: Digital Personal Data Protection Act, 2023
This guide explains the law in plain words as of October 2026. It is not legal advice. Dates that depend on notifications can change, so check the official text before you rely on them.