Consent Docs
Open console

Existing data and retention under the DPDP Act

What India's DPDP Act asks about personal data collected before the Act, and how long data and logs may or must be kept.

Concept4 min readFor everyone

The DPDP Act has rules for personal data you already hold: what to tell people, when to erase and what to keep.

Not legal advice

This page is a summary, not legal advice. It leaves out detail and exceptions, and the law may change. Read the Act and the Rules, and ask your own counsel.

Data collected before the Act#

Section 5(2) deals with personal data a person consented to before the Act commenced.

  • You must give that person a notice as soon as it is reasonably practicable. It says what personal data you hold and why. It also says how to withdraw consent, raise a grievance and complain to the Board.
  • You may keep processing the data until the person withdraws consent. The Act does not ask you to collect consent again.

What is not settled:

  • "As soon as reasonably practicable" is not defined. We found no official guidance on the timing or the channel for this notice.
  • Section 5(2) speaks only of data that was collected with consent. It does not cover data you collected without consent, or data you use for a purpose the person never agreed to. Ask your counsel which basis applies.

Publishing a new version of a form with Ask everyone again shows the notice to returning visitors. Their new answer is recorded.

People who no longer visit can be sent the notice through a notice campaign. Each person gets a single-use link to one published notice version, which your own mailer or SMS gateway delivers. The product records who was sent which version, who acknowledged and who withdrew. See Send a notice to existing customers.

You can also import consent you collected earlier, from a CSV file in Records or from your server. It carries the date it was given, can be marked as given before the Act, and can name the notice the person saw. An import never replaces a newer answer, a withdrawal or an erasure. Keep your original proof of it. See Import consent from a file and Bring in consent given earlier.

When to erase and what to keep#

  • Erase when the purpose is over. You erase personal data when the person withdraws consent, or as soon as it is reasonable to assume the purpose is no longer served. Whichever comes first applies, unless a law requires you to keep the data. You also make your Data Processors erase it (section 8(7)).
  • Erase after inactivity, for large platforms. This applies to e-commerce entities and social media intermediaries with at least 2 crore registered users in India. It also applies to online gaming intermediaries with at least 50 lakh. They must erase a person's data after three years in which the person neither used the service nor exercised their rights. You tell the person at least 48 hours before (Rule 8, Third Schedule).
  • Keep logs for at least a year. Every Data Fiduciary keeps the personal data, traffic data and logs of a processing for at least one year from that processing. The purposes are in the Seventh Schedule (Rule 8(3)).

As we read the Third Schedule, the three years cannot start before the Rules commenced. The Rules start in stages, and we found no statement of which date is meant. Ask your counsel.

How the product helps with retention#

Erase after inactivity erases a person's identifiers after the period you set. It sends a webhook 72 hours before, so that you can warn the person in time. If no webhook address is set up to receive it, nothing is erased. See Erase people after inactivity.

Keep evidence for cannot be set below one year. See Record retention.

Erasing a person follows the one-year rule too. When a record under the Act is erased less than a year after it was last processed, its identifying details are kept until that year is over. A daily job then clears them. In that time the console, receipts and webhooks leave them out. See Withdraw consent or erase a person.

An example#

Kaveri Stores collected marketing consent on its website before the Act commenced. It imports its 2019 opt-in list from a CSV file, marked as given before the Act. It publishes a new version of its form with Ask everyone again, so returning visitors see the notice. It uploads its list of earlier customers to a notice campaign, issues links and sends them through its SMS gateway.

↑↓ to move, Enter to open