====================================================================
STARTING TEMPLATE from dpdprules.org
Retention and erasure schedule

Practical recommendation, not legal advice. Have your legal counsel
review and adapt this before use. Bracketed text marks what you must
fill in.

Provisions tracked: section 8(7) of the DPDP Act 2023 (erasure on
withdrawal or when the specified purpose is no longer served),
Rule 8 of the DPDP Rules 2025 (time periods for the specified
purpose to be deemed no longer served) and the Third Schedule to
the Rules. These sit in the commencement group due eighteen months
from the notification gazette; the computed date 13 May 2027 is
interpretation until officially confirmed. Verified source
references: https://dpdprules.org/act/8 and
https://dpdprules.org/rules/8 and
https://dpdprules.org/rules/third-schedule
====================================================================

Retention and erasure schedule of [organisation name]
Owner: [role]        Last reviewed: [date]

--------------------------------------------------------------------
1. The two erasure triggers under section 8(7)
--------------------------------------------------------------------

Personal data is erased at the EARLIER of:
  (a) the Data Principal withdrawing consent, or
  (b) the moment it is reasonable to assume the specified purpose
      is no longer being served,
unless retention is necessary for compliance with a law in force.
Erasure covers our systems and, under section 8(7)(b), the data we
made available to each Data Processor.

--------------------------------------------------------------------
2. Third Schedule check
--------------------------------------------------------------------

[ ] We have checked whether [organisation name] falls within a
    class of Data Fiduciaries listed in the Third Schedule to the
    DPDP Rules 2025. If yes: apply the time periods the Schedule
    fixes for when the specified purpose is deemed no longer
    served, and note Rule 8 requires informing the Data Principal
    at least forty eight hours before the period completes.
    Read the Schedule's official text:
    https://dpdprules.org/rules/third-schedule

[ ] We have checked Rule 8's separate retention floor: personal
    data, associated traffic data and processing logs must be
    retained for at least one year for the purposes in the Seventh
    Schedule before erasure. Read the official text:
    https://dpdprules.org/rules/8

--------------------------------------------------------------------
3. The schedule
--------------------------------------------------------------------

For each processing activity, one row:

Activity: [name]
  Personal data items: [list]
  Specified purpose: [purpose, matching notice and consent]
  Legal retention duty, if any: [statute and period, or none]
  Purpose no longer served when: [objective trigger: account
  deletion, order completion plus warranty window, contract end,
  Third Schedule period, and so on]
  Erasure method: [deletion, anonymisation approach, backup cycle]
  Processor copies: [which processors hold it and how erasure is
  triggered there]

[Repeat for each activity.]

--------------------------------------------------------------------
4. Operating the schedule
--------------------------------------------------------------------

[ ] Withdrawal of consent triggers erasure within [period] across
    our systems and processors.
[ ] Purpose end triggers are monitored [how and by whom].
[ ] Where a law requires retention past a trigger, the data is
    restricted to that purpose until the legal period ends, then
    erased.
[ ] Erasure runs are logged: what, when, on which trigger.
[ ] This schedule is reviewed [frequency] and when processing
    changes.