RULE 8 – Time period for specified purpose to be deemed as no longer being served
u/s 8(8)
| No | Description |
| (1) | The specified purpose shall be deemed to no longer be served in respect of a data fiduciary who belongs to a class of data fiduciaries specified in column (2) of the Table in Schedule III, for the purpose specified in the corresponding entry in column (3), in relation to a data principal who has not approached such data fiduciary for the performance of such specified purpose and who has not exercised any of her rights in relation to the processing of her personal data, for the time period specified in the corresponding entry in column (4) |
| (2) | The data fiduciary shall, no later than forty-eight hours prior to expiry of the applicable time period for erasure to be effected under sub-rule (1) intimate the data principal that- |
| (a) | her personal data shall be erased upon such expiry since she has not initiated contact with such data fiduciary for the performance of the specified purpose; and |
| (b) | such erasure shall not be effected if, before such expiry, she logs into her user account or otherwise initiates such contact |
| (3) | The intimation under sub-rule (2) shall be given in like manner as is provided for an intimation of personal data breach in sub-rule (4) of rule 7 |
Compliance Checklist — Rule 8 (Data Retention & Erasure)
- Time period for each data processing purpose is clearly defined
- Data is erased when the specified purpose is no longer being served
- System tracks inactivity or lack of engagement from the Data Principal
- Data Principal is notified at least 48 hours before data erasure
- Mechanism exists for users to retain data by re-engaging before expiry
- Erasure process is securely executed and properly logged
- Retention and deletion policies align with Schedule III requirements