to select
to navigate
to close
Search by

SCHEDULE-III – Table of time period

Published by the Secure Privacy Compliance Team · Last reviewed: Feb 2026

See rule 8

Time period for specified purpose to be deemed no longer being served under section 8(8) (Obligations and Legitimate use)

Section 8(8) of the Act(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data Principal does not––
(a) approach the Data Fiduciary for the performance of the specified purpose; and
(b) exercise any of her rights in relation to such processing, for such time period as may be prescribed, and different time periods may be prescribed for different classes of Data Fiduciaries and for different purposes.
Section (8) (7)(a) of the ActA Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,—
(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and

Table

Sl NoClass of Data FiduciariesPurposeTime Period
(1)(2)(3)(4)
1E Commerce Entity having not less than two crore regisetred users in IndiaEvery purpose other than the enablement of the Data Principal to access-
(a) her user account
(b) her money accessible through any service provided or made available by the e-commerce entity; and
(c) any virtual token, object or other similar thing acquired by her, which is usable by her online for accessing or availing of any service provided by the e-commerce entity		Three years from the date which the data principal last approached the e-commerce entity for performance of the specified purpose or three years from the commencement of the digital personal data protection rules 2023, whichever is later
2Online gaming intermediary having not less than two crore registered users in IndiaEvery purpose other than the enablement of the Data Principal to access-
(a) her user account
(b) her money accessible through any service provided or made available by the online gaming intermediary; and
(c) any virtual token, object or other similar thing acquired by her, which is usable by her online for accessing or availing of any service provided by the online gaming intermediary		Three years from the date on which the Data Principal last approached the online gaming intermediary for performance of the specified purpose, or three years from the commencement of the Digital Personal Data Protection Rules 2023, whichever is later
3Social media intermediary having not less than two crore registered users in IndiaEvery purpose other than the enablement of the Data Principal to access-
(a) her user account
(b)her money accessible through any service provided or made available by the social media intermediary; and
(c) any virtual token, object or otehr similar thing acquired by her which is usable by her online for accessing or availing of any service provided by the social media intermediary		Three years from the date on which the Data Principal last approached the social media intermediary for performance of the specified purpose or three years from the commencement of the Digital Personal Data Protection rules 2023, whichever is later
Note: In this schedule,-

(a) “e-commerce” has the same meaning as is assigned to it in the consumer protection act 2019 (35 of 2019)

(b) “e-commerce entity” means any person who owns, operates or manages digital or electronic facility or platform for electronic commerce but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity;

(c) “Intermediary” means a person defined as such in the Information Technology Act, (2000) (21 of 2000)

(d)”Marketplace e-commerce entity” means an e-commerce entity who provides an information technology platform on a digital or electronic network to facilitate transactions between buyers and sellers.

(e) “Online gaming intermediary” means any intermediary who enables the users of its computer resource to access one or more online games;

(f) “social media intermediary” means an intermediary who primarily or solely enables online interaction between two or more users and allows them to create , upload, share, disseminate, modify or access information using her services;

(g) “Seller” means the product seller as defined in clause (37) of section 2 of the Consumer Protection Act, 2019 (35 of 2019) and shall include any service provider

(h) “user” in relation to-
(i) an e-commerce entity, means any person who accesses or avails any computer resource of an e-commerce entity; and
(ii) an online gaming intermediary or a social media intermediary, means any person who accesses or avails of any computer resource of an intermediary for the purpose of hosting, publishing, sharing, transacting, viewing, displaying, downloading or uploading information.

Compliance Checklist — Schedule III (Data Retention & Time Period)

  • Data retention periods are defined for each purpose
  • Personal data is deleted when the purpose is no longer served
  • Data is erased upon withdrawal of consent by the Data Principal
  • Inactive users are identified based on defined time limits
  • Data is deleted after the specified inactivity period (e.g., 3 years)
  • Exceptions are applied only where retention is required by law
  • Different retention periods are applied for different data categories
Scroll to Top