InfraVeritas360DPDPiqDPDP Insights › The law › Section 8(7) · Rule 8
Section 8(7) · Rule 8: Erasure and retention
Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
What it means in your sector
- Banking, financial services and insurance: PMLA and KYC periods set the floor. After them, erase.
- Central government: ministries and departments: Section 17(4) lifts DPDP erasure for the State; public records rules decide retention.
- Public sector undertakings and utilities: If the State provisions do not apply to an activity, normal DPDP erasure applies after legal retention.
Questions where this section matters
- Someone withdraws consent. What has to stop, and how fast?
- Someone asks us to delete their data. Must we?
- How long can we keep personal data?
- Which logs must we keep, for how long, and where?
- Does deletion have to reach backups and test copies?
- What must a vendor contract say about personal data?
- Do we need consent for employee data?
- What about CCTV, visitor registers and biometric attendance?
- What about call recordings and customer service screens?
- Where does personal data live in our organisation?
- How long must we keep KYC and transaction records, and what happens after?
- How long can we keep candidate data?
- Must a ministry delete data when a citizen asks?
- Is our PSU 'the State' under DPDP, and what changes if it is?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.