DPDP data retention and erasure: Rule 8 explained

Indefinite retention stops being a default under this framework. Rule 8 gives the erasure duty its mechanics, and two of them are system behaviours you have to build.

Mechanic one: timed erasure for listed classes

For Data Fiduciaries of the classes specified in the Third Schedule, processing for the listed purposes, personal data must be erased at the listed time periods if the Data Principal neither approaches for the specified purpose nor exercises rights, unless retention is necessary to comply with law. The classes, purposes and periods live in the Third Schedule itself, which this site is ingesting with verification; whether you fall in a listed class is a legal question worth answering precisely.

The Act supplies the parent duty: erase on withdrawal of consent or as soon as it is reasonable to assume the specified purpose is no longer served, whichever is earlier.

Mechanic two: the forty eight hour warning

"At least forty-eight hours before completion of the time period for erasure of personal data under this rule, the Data Fiduciary shall inform the Data Principal that such personal data shall be erased upon completion of such period, unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose or exercises her rights in relation to the processing of such personal data."

That is a scheduled notification pipeline with an exact clock, keyed to each user's erasure date.

Mechanic three: the one year floor for logs and data

Personal data, associated traffic data and processing logs must be retained at least one year from the date of processing for the Seventh Schedule purposes, and then erased, unless another law or a government notification requires longer. The rule's own illustration extends this through your Data Processors: the fiduciary must ensure its cloud provider also retains data and logs for the year.

Where other laws take over

Both the timed erasure duty and the one year floor defer to other laws that require retention. Banking, tax or sectoral record rules can therefore require keeping data the timers would otherwise erase. Which laws bind you is exactly the question this site never guesses at; take it to counsel with your data map in hand.

What to do

Use the retention and erasure planner to compute the one year floor and the warning deadline deterministically, and put the schedule design into your company plan. The official text lives at Rule 8.