Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

DPDP Rules 2025 · Rule 8

Time period for specified purpose to be deemed as no longer being served

Status
Not yet in force
Commencement
13 May 2027 · computed date, presented as interpretation until officially confirmed (how it is computed)
Source
Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) · G.S.R. 846(E) · Gazette page 27
Last verified
26 August 2026

What Rule 8 says, in plain English

Plain English

Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed. The summary below is what the provision says, not what is in force today. Status last checked 28 September 2026 against the MeitY library and India Code.

Personal data held by specified classes of Data Fiduciary must be erased after the periods in the Third Schedule if the Data Principal stays inactive, unless law requires retention. The Data Fiduciary must warn the Data Principal at least 48 hours before erasure, and must keep the data and processing logs for at least 1 year for Seventh Schedule purposes.

How 13 May 2027 is computed, and why it could be 1 day later

Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. The eGazette portal lists this document with a code embedding 14112025 and the Government's own PIB release states 14 November 2025, which would move the computed date by 1 day; the printed masthead date is used, and the interpretation label carries that uncertainty. The corrigendum wording change does not affect this computation.

Official text of Rule 8

Official requirement · verbatim

Rule 8. Time period for specified purpose to be deemed as no longer being served.(1) A Data Fiduciary, who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule, shall erase such personal data, unless its retention is necessary for compliance with any law for the time being in force, or, for the corresponding time period specified in the Third Schedule, if the Data Principal neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing. (2) At least forty-eight hours before completion of the time period for erasure of personal data under this rule, the Data Fiduciary shall inform the Data Principal that such personal data shall be erased upon completion of such period, unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose or exercises her rights in relation to the processing of such personal data. (3) Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government. Illustration. Case 1: X, a Data Principal purchases an e-book on an e-book platform Y. Once delivery is completed, the specified purpose of processing is served. The platform Y must retain the order details, personal data, and logs of the processing (such as order confirmation, payment, and delivery events) for at least one year from the date of the transaction, even if X deletes her account. Case 2: X, a company engages a cloud service provider C as its Data Processor to host customer records. X as the Data Fiduciary, is required to ensure that the C also retains the data and associated logs for at least one year before erasure, unless any other applicable law requires a longer period.

Commencement basis · Rules 3, 5 to 16, 22 and 23

“Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication in the Official Gazette.”

Wording as corrected by corrigenda G.S.R. 892(E).

Sources cited on this page

  1. [1]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Official requirement · Verified 26 August 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmedAll 3 sub-rules and the Illustration are printed on Gazette page 27. Anomaly as printed: sub-rule (1) reads "unless its retention is necessary for compliance with any law for the time being in force, or, for the corresponding time period specified in the Third Schedule, if the Data Principal neither approaches", and the comma after "or" leaves that conjunction without an evident second limb; it is reproduced exactly as printed. Corrigenda G.S.R. 892(E) correct pages 24, 29, 32, 34 and 38 only, so page 27 stands as printed.
  2. [2]
    Draft Digital Personal Data Protection Rules, 2025 (public consultation notification) (G.S.R. 02(E)), r. 8, p. 31. Published 3 January 2025. Official source ↗ · Interpretation, requires judgment · Verified 26 August 2026Document status: superseded by the final Rules G.S.R. 846(E); of historical and consultation record value onlySuperseded draft, not law. Draft rule 8(1) of G.S.R. 02(E) of 3 January 2025, on draft Gazette page 31, reads "compliance with any law for the time being in force, if, for the corresponding time period specified in the said Schedule, the Data Principal neither approaches", without the "or". Reading the 2 prints together, this site takes the Third Schedule period to be the period of inactivity and the law compliance carve out to be a separate exception. That is this site's reading, not a statement either text makes. The draft rule 8 also had no minimum retention floor: its sub-rule (3) was a definition of "user account", which the notified Rules moved to Rule 2(1)(c), so the notified Rule 8(3) floor is new at notification, as is the cross reference to rule 8(3) at the head of the Seventh Schedule.
  3. [3]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Printed text, since corrected by G.S.R. 892(E); quoted as published · Verified 16 August 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette.
    As printed. Corrigenda G.S.R. 892(E) item (i)(b) corrects the closing words to read in the Official Gazette; the computation is unaffected.
  4. [4]
    Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)), p. 1. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · Interpretation, requires judgment · Verified 16 August 2026Document status: published; text subject to corrigendum G.S.R. 892(E)The calendar date 13 May 2027 is computed from the printed publication date and is presented as interpretation until officially confirmed.