Data Retention Thresholds (R.8)

Rule 8 prescribes specific retention thresholds for certain categories of Data Fiduciaries, based on user count thresholds: • E-commerce platforms with 2 crore or more registered users • Online gaming intermediaries with 50 lakh or more registered users • Social media platforms with 2 crore or more registered users For these qualifying platforms, personal data must be erased after 3 years from the last interaction with the Data Principal or from the commencement of the Rules, whichever is later. The Data Fiduciary must provide 48-hour advance notice to the Data Principal before erasure. This threshold operationalises Section 8(7) of the Act, which requires Data Fiduciaries to erase personal data when it is no longer necessary for the purpose for which it was processed.

For personal data processed by or on behalf of the State: • Retention is permitted for up to 1 year after the purpose is fulfilled • This applies to data processed for government functions, welfare schemes, and public administration • After the 1-year period, data must be erased unless another legal basis for retention exists This provision balances the State's administrative needs with Data Principal rights, providing a clear timeline for government data lifecycle management.

Organisations should implement the following to comply with Rule 8: • Build automated data lifecycle management systems that track last access dates • Implement 48-hour notification workflows triggered when the 3-year inactivity threshold approaches • Allow Data Principals to 'reset' the inactivity clock by accessing their data • Define 'access' clearly - does logging in count? Viewing a specific record? Making a transaction? • Establish erasure procedures that remove data across all systems, backups, and processor environments • Maintain erasure logs for compliance documentation • Coordinate with data processors to ensure downstream erasure • Consider data archival strategies that comply with the spirit of Rule 8