Template library

Data retention policy

An operating schedule that gives every data set a trigger, a clock, an owner and an erasure method, plus the 48-hour pre-erasure warning and the one-year log floors. Needed to honour the erasure duties in section 8 (7) of the DPDP Act and rule 8 of the Rules.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to generate as a Word file — no account needed for the preview.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Name][Data Set Name][Data Set Purpose][Consent or named section 7 use][Trigger Event, e.g. account closure][Retention Period][Overriding Statute, if any][Erasure Method][Schedule Row Owner][Systems of Record][If the organisation is an e-commerce entity with at least 2 crore registered users in India, an online gaming intermediary with at least 50 lakh, or a social media intermediary with at least 2 crore, the Third Schedule to the DPDP Rules, 2025 applies: erase three years after her last approach, her last rights exercise, or the Rules' commencement, whichever is latest, keeping only what she needs to access her account and any virtual tokens. Otherwise this paragraph stands down.][Notification Owner][Notification Channel][Organisation Letterhead / Logo][Scheduled Erasure Date][Date of Last Activity][Retention Contact Channel][Approved Erasure Methods Reference][Backup Purge Period][Certificate Custodian][Legal Hold Authority][Exception Approver][Policy Owner]

The document