What Is This Module For?
The Data Retention module helps you define, track, and enforce retention periods for personal data — ensuring data is not kept longer than necessary, as required by the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 8(7) — Personal data must be erased as soon as the purpose for which it was collected is no longer served, and the retention period specified in law has expired.
- DPDP Rules 2025, Rule 8 — Data Fiduciaries must establish and publish their data retention policy.
Note: Different types of data have different legally mandated minimum retention periods. For example, financial records under the Companies Act must be kept for 8 years; tax records under GST for 6 years; employment records vary by state.
Step-by-Step Guide
- Go to Data Retention in the sidebar.
- Click "Add Retention Policy" — select a data category (e.g. Customer Records, Employee Records, Financial Data).
- Set the retention period — enter the duration and the legal basis for that period.
- Link to processing activity — associate each retention policy with the relevant entry in your ROPA.
- Review overdue records — dcomply flags data categories that have passed their retention period.
- Record the erasure — when data is deleted, record the date, method, and quantity for audit purposes.
Common Mistakes to Avoid
- Keeping data "just in case" — This violates the data minimisation principle. Each category must have a documented retention period with a legal basis.
- Not accounting for regulatory minimums — You cannot delete financial or tax records before the legally mandated minimum retention period.
Frequently Asked Questions
Q: What happens to data after the retention period?
A: It must be erased or anonymised. Anonymised data is no longer personal data and can be retained indefinitely.
Q: Do we need to notify data subjects when we delete their data?
A: The DPDP Act does not require notification of deletion, but you must document the erasure for audit purposes.