Short answer: From 13 May 2027, an app must erase personal data when consent is withdrawn or the purpose is no longer served, whichever is earlier, and make its processors erase too (s.8(7)). Rule 8 deems the purpose spent after three years of inactivity for large e-commerce, gaming and social platforms, requires a 48-hour warning before erasure, and sets a one-year minimum retention for processing logs for every app.
What does the DPDP Act say about erasure?
The DPDP Act requires an app to erase personal data on withdrawal of consent, or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, and to cause its Data Processors to erase data made available to them, unless retention is necessary to comply with law (s.8(7)).
- Deemed end of purpose: the purpose is treated as no longer served if the user neither approaches the app nor exercises her rights for a prescribed period (s.8(8), s.8(11)).
- Erasure on request: a user may also ask for erasure, which the app must carry out unless retention is necessary for the specified purpose or for legal compliance (s.12).
Which apps does the three-year rule apply to?
The three-year deemed-expiry period in the Third Schedule applies only to three classes of large platform; for other apps, the general s.8(7) test applies (Rule 8(1), Third Schedule).
| Class (Third Schedule) | Registered users in India | Period |
|---|---|---|
| E-commerce entity | At least 2 crore (20M) | Three years |
| Online gaming intermediary | At least 50 lakh (5M) | Three years |
| Social media intermediary | At least 2 crore (20M) | Three years |
- The three years run from the date the user last approached the platform or exercised her rights, or from the commencement of the Rules, whichever is latest.
- The period does not apply to processing for enabling access to the user account, or to virtual tokens usable to obtain money, goods or services.
What is the 48-hour pre-erasure notice?
At least 48 hours before the erasure period completes, the app must tell the user that her data will be erased unless she logs in, initiates contact or exercises her rights (Rule 8(2)).
How long must an app keep logs?
Every Data Fiduciary must retain personal data, associated traffic data and other logs of processing, including processing by its Data Processors, for at least one year from the date of processing, for the purposes in the Seventh Schedule, and then erase them unless another law requires longer (Rule 8(3)).
- The Rule's illustration describes an e-book platform that must keep order details and logs for at least one year even if the user deletes her account, and a cloud processor that must do the same.
- Separately, Rule 6(1)(e) requires logs and personal data to be retained for one year to detect and investigate unauthorised access.
- Context: the CERT-In Directions of April 2022, a separate IT Act regime, require ICT system logs to be kept for 180 days in India.
How do the one-year minimum and erasure duties fit together?
This is not settled. How the mandatory one-year retention in Rule 8(3) interacts with erasure on withdrawal (s.8(7)) and erasure requests (s.12) is listed as an open question in our research.
- The Rule 8(3) illustration indicates that some data is kept even after a user deletes her account.
- The scope of "logs of the processing" for high-volume analytics events is not defined.
- Rule 8(3) ties the retention to the purposes in the Seventh Schedule. How far that reaches for high-volume analytics logs is a question for legal advice.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider a retention schedule that lists each data set, its purpose, the trigger for erasure and the minimum retention under Rule 8(3).
- If you fall within a Third Schedule class, consider an inactivity job that sends the 48-hour notice and then erases, excluding account-access data and virtual tokens.
- A common approach is to separate operational data from the retained log store, with restricted access to the log store.
- Plan how erasure and withdrawal signals reach SDK vendors and other processors, since s.8(7) requires you to cause them to erase. See processors and SDKs.
- Check that account deletion in the app triggers the right erasure steps, and explain to users what is kept and why.
- Align retention with the security safeguards log requirements and the data principal rights process, and track it in the readiness checklist.