Retention

Retention is governed by the storage-limitation principle: personal data must be kept only as long as necessary for the purpose it was collected for (GDPR Article 5(1)(e); DPDP Section 8(7); PDPA Section 25). A retention policy sets a schedule — by data category and purpose — of how long each item is kept, what triggers erasure (purpose fulfilled, consent withdrawn, user inactivity), and the method of erasure (hard delete, anonymisation).

Three complications arise in practice. First, sectoral laws force minimum retention periods for specific categories (RBI KYC records five years post-closure, SEBI broker records five years, IRS records seven years, HIPAA records six years) that override the general erasure duty for those records. Second, Rule 8(3) of the DPDP Rules 2025 requires a minimum one-year retention of personal data, traffic data and processing logs, which overrides shorter purpose-based periods in India. Third, 'notified e-commerce platforms' under the DPDP Rules face a maximum shelf life for inactive accounts. Reconciling all three in one retention matrix per data category is the operational discipline.