How Long Can Businesses Retain Personal Data Under Indian Law?

Businesses collect personal information through customer registrations, employee records, financial transactions, digital platforms and commercial agreements. However, retaining personal information indefinitely can create privacy, cybersecurity and regulatory risks. Understanding personal data retention India requirements is therefore essential for organisations handling customer, employee and other personal information.

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a purpose based approach to data retention and erasure. However, the law also recognises situations where information must be preserved to meet statutory obligations. Businesses must therefore balance privacy requirements with record keeping duties under taxation, employment, company, banking and other applicable laws.

Is There a Fixed Personal Data Retention Period Under Indian Law?

No. Indian law does not prescribe one universal retention period for every category of personal data. The appropriate retention period depends on the purpose for which information was collected, the nature of the business activity and any applicable statutory record keeping requirement.

For example, an e-commerce business may need customer information to fulfil orders and manage returns. A bank may need to retain customer identification and transaction records for statutory compliance. Similarly, an employer may need to preserve payroll and employment records for taxation and labour law purposes. The general principle is to retain personal information only for as long as necessary for its intended purpose, unless another applicable law requires longer preservation.

What Does the DPDP Act Say About Personal Data Retention?

Section 8(7) of the DPDP Act establishes the principal framework for erasure of personal data. It requires a Data Fiduciary to erase personal data when the individual withdraws consent or when it is reasonable to assume the specified purpose is no longer being served, whichever occurs earlier.

However, erasure is not required where retaining the information is necessary to comply with an applicable law. Section 8(8) further provides for determining when a specified purpose is considered no longer served. The Government can prescribe different periods for different classes of Data Fiduciaries and processing purposes.

This approach means businesses should not adopt arbitrary retention periods. They should document why information is required and identify the legal basis for keeping it. Implementation update: The substantive DPDP provisions, including Section 8, are scheduled to commence on 13 May 2027 under the November 2025 commencement notification. Until then, the existing legal framework remains relevant.

What Is the Retention Requirement Under Rule 8 of the DPDP Rules, 2025?

Rule 8 introduces important requirements concerning the period for which certain personal information may be retained.

1. Three Year Inactivity Period for Specified Businesses

Rule 8(1), read with the Third Schedule, applies to specified large digital businesses:

• E-commerce entities with at least two crore registered users in India.
• Social media intermediaries with at least two crore registered users in India.
• Online gaming intermediaries with at least fifty lakh registered users in India.

For the specified purposes, these organisations must treat the purpose as no longer being served after three years from the relevant last interaction or exercise of rights, or the commencement of the DPDP Rules, 2025, whichever is later.

The requirement is subject to exceptions for information needed to enable access to user accounts and qualifying virtual tokens. This is an important distinction. The three year period is not a general retention permission or a universal deadline applicable to every Indian business. It concerns specified classes of Data Fiduciaries and purposes.

2. Forty Eight Hour Advance Notice

Rule 8(2) requires covered organisations to inform the individual at least 48 hours before the relevant erasure period expires. The individual can prevent the scheduled erasure by logging into the account, initiating contact for the specified purpose or exercising applicable rights. This requires businesses to maintain accurate records of user activity and establish automated notification systems.

3. One Year Minimum Retention Requirement

Rule 8(3) introduces a separate requirement. Data Fiduciaries must retain personal data, associated traffic data and processing logs for at least one year from the date of processing for the purposes specified in the Seventh Schedule. These purposes include specified government functions, national security related interests and compliance assessments concerning Significant Data Fiduciaries.

After the prescribed period, the information must be erased unless another applicable law or Government notification requires further retention.

Rule 6(1)(e) also contains a separate one year requirement for specified personal data and logs needed to detect, investigate and address unauthorised access and security incidents. Businesses should account for both provisions when designing their retention and deletion systems.

What Are the Existing Data Retention Requirements Under Indian Laws?

The DPDP framework does not override other legislation requiring organisations to preserve records. Several Indian laws prescribe specific retention periods.

1. Companies Act, 2013

Section 128(5) of the Companies Act requires companies to preserve their books of account and relevant vouchers for at least eight financial years immediately preceding a financial year. These records may contain personal information relating to directors, employees, shareholders, suppliers and customers. Companies should ensure statutory preservation requirements are met while restricting access to personal information beyond authorised business needs.

2. Income Tax and GST Requirements

Tax related records may contain personal information such as names, addresses, bank details, payment records and transaction histories. Under Section 36 of the Central Goods and Services Tax Act, registered persons must retain relevant accounts and records for 72 months from the due date of furnishing the annual return for the relevant year.

A longer period may apply where an appeal, revision, investigation or other proceeding is pending. Income tax record retention must also be assessed under the applicable provisions governing books, documents and transfer pricing records. Businesses should avoid applying one retention period to every tax related document.

3. Banking and Financial Sector Requirements

Banks and other reporting entities are subject to record preservation obligations under the Prevention of Money Laundering Act, 2002. Section 12 requires transaction records to be maintained for five years from the date of the transaction. Client identity records, account files and business correspondence must generally be preserved for five years after the business relationship ends or the account is closed, whichever is later.

RBI directions may impose additional record keeping requirements on regulated entities. These obligations are particularly relevant to customer identification documents, KYC records, payment information and transaction histories.

4. CERT-In Log Retention Requirements

The CERT-In Directions issued in April 2022 require covered service providers, intermediaries, data centres, body corporates and Government organisations to enable ICT system logs and retain them securely for a rolling period of 180 days within Indian jurisdiction. Certain service providers, including cloud and data centre providers, have additional information retention requirements. Importantly, cybersecurity log retention should not automatically be confused with the retention period for every category of personal data.

What Happens When the Purpose of Collecting Personal Data Is Completed?

Once the original purpose has been fulfilled, businesses should assess whether there is any continuing legal or operational justification for retaining the information. For example, an online retailer may no longer need a customer’s address for delivery once an order has been completed. However, relevant transaction records may still need to be retained for GST, accounting or consumer dispute purposes.

Similarly, an employer may no longer need an employee’s recruitment documents after the hiring process, but certain employment and payroll records may need to be preserved under applicable laws. Organisations should distinguish between information needed for ongoing operations and records retained solely to meet statutory requirements.

Can Businesses Delete or Anonymise Personal Data?

Yes. Deletion and anonymisation are important tools for reducing data protection risks. Deletion involves removing personal information so it is no longer available for ordinary processing. Anonymisation involves modifying information so individuals can no longer reasonably be identified. Where genuine anonymisation is achieved, the resulting information may fall outside the DPDP Act’s definition of personal data.

However, merely removing names or replacing identifiers with codes may not be sufficient. If an individual can still be identified by combining the information with other available records, the information may remain personal data. Businesses should also consider backup systems, archived records and third party processors when implementing deletion procedures.

How Should Businesses Develop a Personal Data Retention Policy?

An effective retention policy should identify the categories of personal information collected and the business purposes for processing each category. Organisations should map information across customer databases, HR platforms, financial systems, cloud storage and external service providers. They should then identify the applicable statutory retention periods and establish suitable deletion dates. Where information must be retained for legal proceedings, audits or regulatory investigations, a documented legal hold should temporarily suspend routine deletion.

Businesses should also review retention schedules periodically. Changes in legislation, regulatory directions, business activities and contractual obligations may require adjustments. Seeking advice from experienced data protection lawyers for retention matters can help organisations identify applicable retention obligations, assess conflicting legal requirements and develop legally appropriate deletion policies. Similarly, technology lawyers for data management can assist with cloud storage arrangements, database management, vendor agreements, automated deletion mechanisms and technology related compliance.

What Are the Risks of Retaining Personal Data for Too Long?

Excessive data retention increases the amount of information exposed to cybersecurity incidents, unauthorised access and accidental disclosure. It can also create difficulties when responding to individual rights requests, regulatory investigations and contractual disputes.

Under the DPDP Act, failure to comply with applicable obligations may attract regulatory consequences once the relevant provisions commence. Failure to implement reasonable security safeguards can attract a financial penalty of up to ₹250 crore under the statutory Schedule. Businesses should therefore treat retention as an ongoing governance responsibility rather than a one time administrative exercise.

Conclusion

Indian law does not establish one fixed retention period for all personal information. Businesses must determine appropriate periods by considering the purpose of processing, the applicable DPDP framework and other statutory record keeping requirements. The DPDP Rules, 2025 introduce specific inactivity based erasure requirements for certain large digital businesses and separate one year retention obligations. At the same time, company, tax, banking and cybersecurity laws may require information to be preserved for longer periods. A well structured retention policy, supported by accurate data mapping, documented legal justifications and secure deletion procedures, can help organisations balance regulatory compliance with individual privacy rights.