What does DPDP say about retention?

DPDP Section 8 (Rule 8 of DPDP Rules 2025 draft) requires personal data to be erased when the purpose is served, unless retention is required by law. Erasure includes anonymisation. Failure to erase carries penalty up to ₹250 crore under the security-safeguards head.

How do RBI/GST/MSMED retention rules interact with DPDP?

These sectoral rules override DPDP: RBI KYC records. 5 years post-account-closure, 10 years for suspicious transactions; GST invoices. 8 years; MSMED records, statute-of-limitation; Companies Act minutes. 8 years. dcomply flags each field with the strictest legal retention.

How does dcomply schedule retention?

Each processing record in dcomply has a retention policy, either legal (sectoral rule) or purpose-based (business justification). When the retention clock expires, dcomply runs the configured strategy: nullify PII fields, delete records, or crypto-shred (S3 versioning aware). Every action is hash-chained.

What is anonymisation vs pseudonymisation for retention?

Anonymisation permanently removes the ability to re-identify, after anonymisation, data is no longer personal data and DPDP no longer applies. Pseudonymisation replaces identifiers with tokens; the token mapping is still personal data and DPDP still applies. dcomply supports both with clear labelling.

Can I retain PII for AI training after purpose is served?

No, under DPDP the original purpose is exhausted once the transaction is complete. AI training is a new purpose that requires fresh, purpose-scoped consent. Retaining PII for future undefined 'AI improvement' is a common compliance failure.

What is DPDP's treatment of backups?

Backups containing PII fall within scope. Practical guidance: pseudonymise backups by encryption at rest, honour DSR-driven erasure at the next backup cycle (documented lag < 30 days), and retire the backup at the end of business-continuity retention (typically 6-12 months for operational, 7 years for regulatory-mandated).

Data Retention Manager

Automated Data Retention for DPDP Compliance

Under the DPDP Act, retaining personal data longer than necessary is a violation. dcomply's Data Retention Manager helps you define, enforce, and audit retention schedules for every category of personal data your organization holds.

Try the live product

Personal Identifiers Retention: 3 yrs | Review: Mar 2027

Financial Data Retention: 5 yrs | Review: Mar 2027

Health & Medical Retention: 7 yrs | Review: Mar 2027

Consent Records Retention: 3 yrs | Review: Mar 2027

The Problem

Retention Without Policy Is a Liability

Under DPDP Act Section 8(7), retaining personal data beyond its purpose is a direct violation, and most organizations have no system in place

No Clear Retention Rules

Most organizations have no documented retention schedules. The DPDP Act requires erasing data when purpose is served (Section 8(7)), but without policies, this never happens.

Manual Tracking Is Error-Prone

Spreadsheet-based retention tracking misses records, skips categories, and provides no audit trail. A regulator asking "what data do you hold and for how long?" can't be answered.

Legal Bases Are Inconsistent

Different data types have different legal retention requirements. 8 years for tax records (IT Act), 5 years for financial data (RBI), 3 years for contracts. Without a system, organizations either over-retain (liability) or under-retain (compliance breach).

Capabilities

Complete Retention Lifecycle Management

Retention Schedule Builder

Create schedules for 8 data categories (Personal Identifiers, Financial, Health, Employment, Customer, Consent & Legal, Children's Data, Third-Party) with custom retention days, legal basis, and deletion method.

Auto-Delete Workflows

Enable auto-delete for any policy. When the retention period expires, the system flags the record for deletion and logs the action in an audit-ready trail.

Legal Basis Mapping

Tag each policy with the correct legal basis: Consent (Section 6), Legitimate Use (Section 7), Regulatory Requirement (RBI/SEBI/IT Act), or Tax Compliance (8 years). Defensible in any audit.

Review Alerts

Never miss a scheduled review. Get email alerts when a retention policy is due for review, ensuring policies stay current as regulations change.

Multi-Category Management

Manage retention for every data type, from Aadhaar and PAN records to employee performance data and API logs. All in one dashboard.

Audit-Ready Reports

Export a complete Data Retention Register as PDF with all policies, legal bases, retention periods, and deletion methods, ready for Data Protection Board inspection.

How It Works

Build Your Retention Register in 4 Steps

From data categories to audit-ready policies, dcomply handles the structure so you can focus on accuracy.

Define data categories

Select from 8 standard categories or create custom ones. Assign each a data type, description, and storage location.

Set retention periods

Enter retention days or use suggested defaults (e.g., 8 years for tax records, 5 years for financial data, 3 years for consent records). Tag the applicable DPDP section.

Choose deletion method

Select Secure Digital Deletion, Anonymisation, Pseudonymisation, Crypto Erasure, or Physical Shredding based on the data type.

Activate and monitor

Enable auto-delete, set review intervals, and get alerts. The system tracks every policy and generates audit evidence automatically.

FAQ

Frequently Asked Questions

The DPDP Act does not prescribe fixed retention periods, it requires erasure when the purpose is served (Section 8(7)). However, other laws impose minimum periods: IT Act requires 8 years for tax records, RBI mandates 5 years for financial data, and employment law typically requires 7 years for employee records. dcomply helps you map the correct legal basis and period for every data category.

dcomply supports Secure Digital Deletion (overwriting), Anonymisation (removing all identifiers), Pseudonymisation (replacing with tokens), Cryptographic Erasure (destroying encryption keys), Physical Shredding (for paper records), and Archival (offsite with no access). The appropriate method depends on the sensitivity and format of the data.

Yes. The Data Retention Manager is multi-tenant, each client has their own retention policies, schedules, and audit logs. DPOs and compliance consultants can manage retention for multiple clients from a single dashboard.

Build Your Data Retention Register Today

DPDP-compliant retention schedules in under an hour

View All Features