Removed: personal data kept beyond three years of a person’s last activity on large e-commerce, online gaming and social media platforms, with at least forty-eight hours’ notice before erasure.
Outcome: a statutory retention ceiling for the largest platforms, a definition of “reasonable security safeguards” in Rule 6, and a one-year minimum retention floor for personal data, traffic data and logs.
India has turned the principle into a deadline, starting with the largest platforms. Under the DPDP Rules 2025, notified on 13 November 2025, large e-commerce, online gaming and social media platforms must erase personal data once the specified purpose is deemed no longer served, notify the person at least forty-eight hours before erasure, and keep nothing beyond three years of that person’s last activity.
Rule 6 states what “reasonable security safeguards” means for everyone: encryption, obfuscation, masking or virtual tokens mapped to that personal data.
The same rulebook also sets a floor, requiring personal data, traffic data and logs to be held for a “minimum period of one year” for the purposes in its Seventh Schedule.
Source: MeitY, DPDP Rules 2025, G.S.R. 846(E) (13 November 2025)