Rule 8, erasure and the retention floor
In short
Rule 8 does two things that pull in opposite directions. It requires certain classes of Data Fiduciary to erase personal data after a period of Data Principal inactivity specified in the Third Schedule, and it requires every Data Fiduciary to retain personal data, associated traffic data and logs of processing for at least one year from the date of processing.
Note the title. Rule 8 is not a general retention and erasure rule. It sets the time period after which a specified purpose is deemed no longer to be served.
01Who the erasure obligation applies to
| Class of Data Fiduciary | Threshold | Period |
|---|---|---|
| E-commerce entity | Not less than two crore registered users in India | 3 years |
| Online gaming intermediary | Not less than fifty lakh registered users in India | 3 years |
| Social media intermediary | Not less than two crore registered users in India | 3 years |
The three year period runs from the date on which the Data Principal last approached the Data Fiduciary for performance of the specified purpose or exercised her rights, or from the commencement of the Rules, whichever is latest. The obligation does not apply where retention is necessary for compliance with any law in force, and it excludes data needed to enable the Data Principal to access her user account or a virtual token issued by or on behalf of the Data Fiduciary that may be used to get money, goods or services.
02The forty eight hour warning
At least forty eight hours before completion of the period, the Data Fiduciary must inform the Data Principal that the personal data will be erased on completion of that period, unless she logs into her user account, otherwise initiates contact for performance of the specified purpose, or exercises her rights in relation to the processing.
This is an outbound notification obligation with a hard lead time attached, and it needs the same delivery capability as a breach intimation.
03The one year retention floor
Rule 8(3) applies without prejudice to the erasure obligation. In respect of any processing undertaken by the Data Fiduciary or on its behalf by a Data Processor, personal data, associated traffic data and other logs of the processing must be retained for a minimum period of one year from the date of processing, for the purposes specified in the Seventh Schedule, after which they are to be erased unless further retention is required for compliance with any other law in force or notified by the Government.
The illustrations in the rule make the reach explicit. Where a company engages a cloud service provider as its Data Processor to host customer records, the company as Data Fiduciary must ensure that the provider also retains the data and associated logs for at least one year before erasure.
04Common questions
Does Rule 8 apply to every company?
The Third Schedule erasure obligation applies to the three classes of Data Fiduciary listed in it, at the stated user thresholds. The one year retention obligation in Rule 8(3) is not limited to those classes.
Is the erasure period three years for everyone?
The Third Schedule specifies three years for each of the three listed classes, running from the latest of the last approach by the Data Principal, the last exercise of her rights, or commencement of the Rules.
What must be told to the Data Principal before erasure?
That the data will be erased on completion of the period, unless she logs in, initiates contact for the specified purpose or exercises her rights. The notice is due at least forty eight hours in advance.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.