How long can we keep personal data?

Short answer: For the legal or business period, then erase

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

What the law says

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs.

Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

List the record types you hold.
Write the period for each, with the law, regulator rule or business reason.
Set a trigger for the period to start: end of relationship, date of transaction, exit date.
Automate deletion where you can; for paper, schedule shredding.
Keep a deletion log.

Evidence to keep

Retention schedule approved by Legal
Deletion log
Shredding or disposal certificates

Common mistakes

'Keep everything forever' because storage is cheap
Deleting before the legal minimum
Forgetting email, shared drives and backups

How it plays out by sector

Banking, financial services and insurance: PMLA and RBI KYC rules set the floor at five years for identity and transaction records.
IT, ITeS, BPO and GCC: Candidates, employees, alumni, and client data at project end.
Central government: ministries and departments: Record retention schedules under public records rules decide periods.
Public sector undertakings and utilities: Pension and service records are kept long; consumer records follow legal and business needs.
Healthcare and hospitals: Indoor records at least 3 years (2002 regulations), PCPNDT 2 years, MTP 5 years, Schedule H1 3 years.

From each seat

DPO / Privacy lead: Draft the schedule, but get Legal and each department head to sign their rows. Your role is to make sure deletion actually happens.
HR head: Ex-employee files are the usual pile-up. Set a period by record type, with labour-law minimums, and delete after it.
Administration department: Visitor registers, gate passes and paper files need a period and a shredding date.
HR department: Set periods for candidate, employee and ex-employee records.
Finance department: Tax and audit rules require keeping some records for years. List them so they are kept, and the rest is deleted.

What a good answer from management sounds like

“We have one retention schedule, approved by Legal. Deletion runs on it, and we can show the log.” Effort and time: Medium · 8 to 12 weeks.