DATA RETENTION AND ERASURE UNDER THE DPDP Act, 2023

Introduction

The document examines the framework governing data retention and erasure under the Digital Personal Data Protection Act, 2023 (DPDP Act). Its primary objective is to explain how the Act regulates the duration for which organizations may retain personal data and the circumstances requiring its deletion. The discussion focuses on statutory obligations, rights of Data Principals, interaction with other laws, the DPDP Rules, 2025, judicial developments, and constitutional challenges. The Act replaces indefinite data storage with a purpose-based retention regime while preserving statutory exceptions.

Background

The DPDP Act establishes that personal data must be deleted once the purpose for which it was collected has been fulfilled unless another law expressly requires longer retention. It also grants individuals the right to seek deletion of their personal data. Data cannot be retained merely because it may prove useful in the future.

Key Legal Issues and Main Themes

• Section 8(7) requires deletion of personal data once consent is withdrawn or the specified purpose ceases, whichever occurs first, unless another law requires retention.
• Organizations must proactively review and delete unnecessary personal data without waiting for requests. The Act illustrates this by contrasting online marketplace transactions with bank account closures, where banking regulations require longer retention.
• Section 8(8) introduces the concept of a dormancy period. Under the DPDP Rules, 2025, specified large online platforms must erase inactive users’ personal data after three years of inactivity, subject to a mandatory 48-hour advance notice.
• Section 12 grants Data Principals the right to request correction, updating, and erasure of personal data. This right primarily applies to consent-based processing. Organizations may refuse to be erased where retention remains necessary for the original purpose or is required by another law. The Rules also prescribe response timelines and require reasons to be communicated when requests are refused.

Important Statutory Provisions

Important Judicial Decisions

The document examines the pending Supreme Court challenge concerning Sections 44(3) and 17(1)(c), including reference to CPIO, Supreme Court of India v. Subhash Chandra Agarwal (2019). It also discusses Jorawer Singh Mundy v. Union of India, Dharamraj Bhanushankar Dave v. State of Gujarat, Karthick Theodre v. Registrar General, Madras High Court, and Justice K.S. Puttaswamy v. Union of India (2017).

Core Arguments

The DPDP Act shifts Indian data protection law from indefinite retention to purpose-limited retention. Organizations must justify continued retention through statutory authority while individuals enjoy enforceable erasure rights subject to legal exceptions.

Major Findings and Analysis

The Act co-exists with sector-specific laws governing banking and healthcare records. Rather than overriding them, Sections 8(7) and 12(3) preserve statutory retention obligations wherever another law requires continued retention. The framework will continue to evolve through subordinate legislation, the Data Protection Board, and judicial interpretation.

How JTS Lex Can Assist?

Conclusion

The DPDP Act represents a significant shift in Indian data protection law by requiring organizations to retain personal data only for as long as necessary to fulfil the specified purpose. Organizations should establish purpose-based retention and deletion practices proactively to ensure compliance as enforcement develops.