Template library

Data retention policy

An operating schedule that gives every data set a trigger, a clock, an owner and an erasure method, plus the 48-hour pre-erasure warning and the one-year log floors. Needed to honour the erasure duties in section 8 (7) of the DPDP Act and rule 8 of the Rules.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Name][Data Set Name][Data Set Purpose][Consent or named section 7 use][Trigger Event, e.g. account closure][Retention Period][Overriding Statute, if any][Erasure Method][Schedule Row Owner][Systems of Record][If the organisation is an e-commerce entity with at least 2 crore registered users in India, an online gaming intermediary with at least 50 lakh, or a social media intermediary with at least 2 crore, the Third Schedule to the DPDP Rules, 2025 applies: erase three years after her last approach, her last rights exercise, or the Rules' commencement, whichever is latest, keeping only what she needs to access her account and any virtual tokens. Otherwise this paragraph stands down.][Notification Owner][Notification Channel][Organisation Letterhead / Logo][Scheduled Erasure Date][Date of Last Activity][Retention Contact Channel][Approved Erasure Methods Reference][Backup Purge Period][Certificate Custodian][Legal Hold Authority][Exception Approver][Policy Owner]

The document

The opening clauses — open to everyone

The rule in one sentence

[Organisation Name] keeps a personal data set only while a stated trigger in the schedule below holds; once no trigger holds, we erase it everywhere — our systems, our backups, and our processors' systems.

What the law requires of us

Section 8 (7) of the DPDP Act, 2023 obliges us to erase personal data "upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier", unless retention is necessary for compliance with law — and to cause our Data Processors to erase likewise. Section 8 (8) makes purpose-lapse objective: the purpose is deemed no longer served once the Data Principal has neither approached us for it nor exercised any right, for the prescribed period. "As long as necessary" is therefore not a retention period in this organisation; every row below carries a trigger and a clock.