Pension and service records are kept long; many others are not. RTI requests also reach records you hold, and personal information is now exempt.
The first four things to sort out
Own one retention schedule by record type.
Log every destruction with a certificate.
Lock record rooms and log file movement.
Find files fast for requests and RTI.
A worked example
Records and archives department
Old allotment files at a state development corporation
Week 1The record room finds allotment applications far older than the schedule.
Week 2Files linked to disputes, audits or pending RTI appeals are separated.
Week 3The rest are destroyed with a certificate and a log.
AfterFile movement is logged and destruction runs every quarter.
Evidence kept
Retention schedule
Destruction log
Certificate
Separate what must be kept, then destroy the rest with a record.
What others in the sector usually do. PSUs commonly start with old allotment and connection files.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
Oil and gas marketing
Distributor registers and delivery slips with addresses; Subsidy and Aadhaar data in distributor software; Consumer numbers shared with marketing partners
Power generation and transmission
Contract labour gate passes and biometrics; PSU hospital records of employees and families; Township allotment and resident records
Electricity distribution (state discoms)
Smart-meter data held by the meter vendor; Billing files shared with collection agencies; Consumer lists exposed on public bill lookup pages
Transport undertakings (rail PSUs, metro, state road transport)
Passenger lists and reservation charts; Concession passes with ID copies; CCTV and travel-card data
Steel, mining, defence production and heavy industry
Medical surveillance records of workers; Township and school records; Resettlement and compensation records of affected families
State development corporations and boards
Lottery and allotment lists published with full details; Ration and supply records; Old paper files in record rooms
7 questions the Records and archives department asks, answered in full
These hold residents', patients' and students' data. Each needs a notice, access limits and retention. PSU hospital records follow medical record rules; school records may involve children, where Fourth Schedule exemptions for educational institutions and healthcare may apply to some purposes.
Short answer: For the legal or business period, then erase
Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.
From your seat: Records and archives department. Own the schedule and the destruction log.
Example in PSUs and utilities
Pension and service records are kept long; consumer records follow legal and business needs.
What the law says
Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.
Evidence to keep
Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates
Common mistakes
'Keep everything forever' because storage is cheap
Short answer: Yes, unless a law requires you to keep it
You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.
From your seat: Records and archives department. Explain clearly what is kept and why.
Example in PSUs and utilities
If State provisions do not apply to the activity, normal erasure applies after legal retention.
What the law says
Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8
Steps
Log the request and verify identity.
Check the retention schedule for each record type involved.
Delete what has no legal reason to stay, including copies with vendors and in test systems.
Mark what must stay, with the law and the end date.
Reply in plain words: what was deleted, what is kept, why and until when.
Evidence to keep
Erasure log
Vendor deletion confirmations
Reply to the person
Common mistakes
Refusing every erasure request 'because of backups'
Short answer: Yes, through a written backup-expiry rule
Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.
From your seat: Records and archives department. Old backups are records too.
Example in PSUs and utilities
Backups of billing and ticketing systems follow retention.
What the law says
Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.
Evidence to keep
Backup retention settings
Written backup-expiry rule
Masking procedure for test data
Common mistakes
Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back
Short answer: Yes, a clear summary, inside the published timeline
Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.
From your seat: Records and archives department. Find records fast when someone asks.
Example in PSUs and utilities
Consumers can ask who received their data: distributors, franchisees, payment partners.
What the law says
Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14
Steps
Log the request in one register the day it arrives.
Verify identity using details you already hold.
Search every system, including vendors' copies.
Write a plain summary: what data, why it is used, who received it.
Send it, and file the request, search notes and reply.
Short answer: Yes, when the request is lawful and in writing
Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.
From your seat: Records and archives department. Log what was released.
Example in PSUs and utilities
Police and agencies ask for consumer details; log each request.
What the law says
Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6
Steps
Route every such request to Legal.
Check the authority, the legal power and the scope.
Share only what is asked, by a secure method.
Log the request, what was sent, by whom and when.
Tell the person, unless the law or the authority says you must not.
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Records and archives department. A missing file is a breach.
Example in PSUs and utilities
A leaked consumer list from a distributor is your breach to report.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Only IT knowing the plan
The sections you will use most
Section 8(7) · Rule 8: Erasure and retention. If the State provisions do not apply to an activity, normal DPDP erasure applies after legal retention.
Section 8(5) · Rule 6: Security safeguards. Large consumer systems and plant systems both need safeguards; some are protected systems.
Sections 11–14 · Rule 14: Rights of people. Consumers can ask what you hold and who you shared it with.
Other rules that sit alongside DPDP
Rule
What it says
What it means alongside DPDP
Source
DPDP Act, Section 2(x) and Article 12 of the Constitution
The Act defines 'State' with the meaning in Article 12. Many PSUs have been treated as 'the State' by courts, depending on government control.
Get a legal view on which activities can rely on Section 7(b), 7(c) and 17(4). Customer-facing commercial work usually follows full duties.
MeitY
CERT-In Directions, 2022
Report specified cyber incidents within six hours; keep ICT logs 180 days in India.
Applies to every PSU.
CERT-In
IT Act, Section 70 and NCIIPC
Systems notified as protected systems come under NCIIPC's critical information infrastructure framework.
Plant control, grid and pipeline systems may be notified; personal data in them follows DPDP too.
NCIIPC
CEA (Cyber Security in Power Sector) Guidelines, 2021
Cyber security requirements for power sector utilities, including incident reporting and supply chain controls.
Power PSUs and discoms can use this evidence for DPDP Rule 6.
Central Electricity Authority
Aadhaar Act, 2016
Aadhaar-linked subsidies such as LPG must store Aadhaar numbers securely and limit sharing.
Distributor systems and counters must not keep Aadhaar copies.
UIDAI
Labour Codes (in force from 21 November 2025)
Registers for workers and contract labour, health and safety records for hazardous work.
Set retention for worker and contract labour records against the codes and state rules.
Ministry of Labour
SEBI LODR Regulations (listed PSUs)
Listed PSUs follow disclosure and governance rules.
Board-level reporting on data protection fits into existing risk committee work.
SEBI
RTI Act, Section 8(1)(j) as amended
Personal information is exempt from RTI disclosure since 13 November 2025.
PSU CPIOs should apply the new wording with reasoned orders.
SFLC.in summary
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
