How long must personal data be kept, and when must it be erased?

Verified August 2026

Two separate periods apply and they do different jobs. Rule 6(1)(e) requires security logs, and the personal data in them, to be kept for one year. Rule 8 requires certain large platforms to erase personal data after three years of dormancy. Neither Rule starts before 13 May 2027.

The one year floor

Rule 6 sets out the reasonable security safeguards a Data Fiduciary must take. Rule 6(1)(e) requires logs and the personal data in them to be retained for one year. The purpose is to let a breach be detected and investigated after the event. One year is a floor for that data, not a ceiling for everything else.

The three year dormancy trigger

Rule 8 deals with erasure. Where a Data Principal has not approached the Data Fiduciary for the specified purpose, and has not exercised any right, for three years, the personal data must be erased. The Third Schedule sets which classes of Data Fiduciary this applies to and the thresholds involved. The Data Fiduciary must give the Data Principal at least forty-eight hours notice before erasing the data.

Why the two do not conflict

One year is shorter than three years, so the two periods do not overlap. The Rule 6(1)(e) log period of one year ends before an account completes three years of dormancy. Both Rules also save other law. Where any law in force requires the data to be kept, that requirement prevails.

Published guidance often describes the two Rules as contradictory. The two periods do not overlap.

What this means before May 2027

Neither Rule is in force. Both start on 13 May 2027, subject to the note about the commencement date on the status tracker. A Data Fiduciary designing a retention schedule now is designing for a date, not complying with a duty.

One older duty does still apply. Section 44(2) of the Act, which omits section 43A of the Information Technology Act, 2000, is also not in force. Section 43A and the rules made under it therefore remain law until May 2027.