Platform · Retention and erasure
Decide how long each kind of data stays, then make sure it actually goes.
Set a retention period for each purpose, with the law or business reason behind it, and let TrustOS raise erasure work when that period ends. Legal holds, tax records and other exceptions are recorded, so nothing is deleted that should stay and nothing stays that should go.
The problem
Everyone agrees on deletion until it is time to delete
An NBFC closes a personal loan in March. Collections still has the call recordings, the CRM still has the lead, the data warehouse has nightly copies and an S3 archive holds the KYC scans from 2019. Nobody owns the question of when each copy should go, and nobody wants to delete something that audit or a court might ask for later. So everything is kept, and the risk grows with every year of history.
What the DPDP Act asks
The DPDP Act asks a Data Fiduciary to erase personal data once the purpose is served or consent is withdrawn, unless another law requires it to be kept, and to make its processors do the same. The DPDP Rules add a fixed outer limit for certain large e-commerce, online gaming and social media platforms above user thresholds: three years after a user was last active, with at least 48 hours' notice before erasure. The Rules also expect logs and related personal data to be kept for at least a year for detecting and investigating incidents.
A plain summary. It is not legal advice. Read the DPDP Act guide.
Erasure, everywhere it lives
One request out, a confirmation back from each system
The erasure plan comes from the data inventory. Connectors act where they can, processors confirm, people close manual tasks, and anything kept under a legal duty is recorded with its reason.
What it does
What retention and erasure gives your team
Retention rules tied to purposes
Each rule names the purpose, the data categories, the period and the trigger, such as loan closure or last login. The reason is written down too: the Income-tax Act for fee invoices, RBI record keeping for KYC, or simply the end of service.
Exceptions that are visible
A legal hold on a disputed account, an open grievance or a tax record that must stay is recorded against the data, with the person who placed it and an end date. Erasure for that data pauses with a reason, and stays paused until the hold ends.
Due lists, a month ahead
Every week TrustOS lists the records whose period ends in the next 30 days, grouped by system and owner. The edtech team sees 4,200 lapsed trial accounts before they are due.
Notice before erasure
Where the Rules require notice before erasure, TrustOS schedules the message to the Data Principal at least 48 hours ahead and records that it went. A user who logs in during that window stops the clock.
Erasure, masking or archive
Not every copy needs the same treatment. You choose per system whether data is deleted, masked in place, or moved to restricted cold storage until a hold ends, and the record shows which was done where.
Processor follow through
When the purpose ends, processors holding the data get an erasure request from the same task. Their confirmation, or the lack of one, sits next to your own systems in the record.
How the work moves
Step by step, inside TrustOS
- Step 1Set the rulePrivacy and legal approve a retention rule for a purpose, with the period, trigger and the law or reason behind it.
- Step 2Map the copiesThe rule is linked to every system in the data inventory that holds that data, including backups, exports and processors.
- Step 3Raise the due listWhen records reach the end of their period, TrustOS raises erasure tasks per system and checks for holds first.
- Step 4Approve and actThe system owner approves, and the action runs through a connector or is done by hand and confirmed.
- Step 5Close with proofCounts, timestamps and any failures are recorded, and partial erasures stay open until the gap is fixed.
Records it keeps
The evidence builds as you work
- Retention schedule by purpose, with the legal or business reason
- Legal holds and other exceptions, with owner and end date
- Erasure notices sent to Data Principals and their delivery status
- Erasure, masking and archive actions per system, with counts
- Processor erasure requests and confirmations
- Rule change history with approver and date
Who uses it
The teams who rely on it most
The first team usually leads the work. The others act on what it assigns.
Questions
About retention and erasure
Does TrustOS decide how long we must keep data?
No. Your privacy and legal team sets each period, often after checking sector rules such as RBI or tax record keeping. TrustOS records the decision and the reason, and makes sure it is carried out. It does not replace legal advice.
What about backups we cannot edit record by record?
Many teams cannot erase one person from a backup. You record how the backup is handled, for example that it expires after 35 days and is never restored for business use, and TrustOS keeps that position with the rule so it can be explained.
Can we mask data and keep the record?
Yes, where your team decides masking meets the need, for example keeping transaction totals in the data warehouse with names and phone numbers removed. The record shows which method was used in which system.
Keep going
Related modules and reading
Module
Data inventory
A working record of what personal data you hold, where it sits and who touches it.
Learn moreModule
Connectors and actions
Find a person's data in your systems, act on it, and record what really happened.
Learn moreModule
Processors and assessments
Know which vendors handle your personal data, on what terms, and what could go wrong.
Learn moreGuide
Executing retention and erasure across systems
A retention schedule changes nothing until something acts on it. Set periods you can defend, reach every copy, handle legal holds and backups, and record what was actually deleted.
Learn moreGuide
Connecting TrustOS to the systems you already run
An erasure that someone says they did is weaker evidence than one the system itself confirms. TrustOS connectors are scoped, approved and checked, and systems without a connector are still covered.
Learn moreGuide
Linking purposes to grounds and notices
Under the DPDP Act almost everything follows from the purpose you process data for. A purpose register keeps the ground, the notice versions and the retention rule moving together.
Learn moreSee it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.