Rule 8 — DPDP Rules, 2025
For the purposes of sub-section (7) of section 8, the period after which it shall be deemed that the personal data is no longer necessary for the purpose for which it was collected, shall be as specified in the Third Schedule. Third Schedule (selected entries): — E-commerce platforms: 3 years from last purchase or account closure, whichever is earlier. — Social media platforms: 3 years from last interaction or account closure. — Online gaming platforms: 3 years from last gameplay or account closure. — OTT platforms: 3 years from last streaming activity or account closure. — Ride-hailing services: 3 years from last ride or account closure.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 8 and the Third Schedule replace the judgment call about storage limitation with a fixed timeline for specific platform categories. For platforms listed in the Third Schedule, the retention clock is pre-set: three years from the last qualifying activity or account closure, whichever is earlier. After that period, the data is deemed no longer necessary and must be erased. For platforms not in the Third Schedule, Data Fiduciaries must determine their own 'necessary' period based on their specific purposes. The Third Schedule removes ambiguity for the covered categories — there is no argument that 'we might need it later' once the period expires.
A customer last purchased from an e-commerce platform on 1 January 2024 and then closes their account. Their data must be erased by 1 January 2027 (3 years from last purchase) or the account closure date, whichever is earlier. If the customer closed their account on 1 June 2024, the erasure deadline is 1 June 2027. If they never closed it but made no purchases, it is 1 January 2027.
GST records must be retained for 6 years under the GST Act. An e-commerce platform's invoice data can be retained for 6 years even if the Third Schedule's 3-year period expires, because a legal obligation under another law requires retention. Only the data with a specific legal retention obligation is kept — all other data must be erased at the Third Schedule deadline.
Banks and insurance companies are not listed in the Third Schedule. They must determine their own 'necessary' period for each data category, guided by the purposes for which data was collected. RBI's KYC retention requirements (10 years) would govern KYC data. Marketing data with no legal retention requirement would be governed by the Section 6 withdrawal and Section 8(7) storage limitation.