Rule 8 — Time Period for Specified Purpose to Be Deemed as No Longer Being Served

Section 8(7) of the Act requires a Data Fiduciary to erase personal data once the specified purpose is no longer being served, and Section 8(8) says a purpose stops being served once the Data Principal stops approaching the Fiduciary for it and stops exercising her rights, "for such period as may be prescribed." Rule 8 is that prescription — and for the classes of Data Fiduciary it names, it removes the judgment call entirely by hard-coding an exact time period in the Third Schedule.

The three-year clock — Rule 8(1) and the Third Schedule

The Third Schedule currently names three classes: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh registered users in India, and social media intermediaries with at least two crore registered users in India. For these, personal data has to be erased three years from the date the Data Principal last approached the platform for the relevant purpose or exercised her rights — or from the Rules' own commencement date, whichever is later — unless retention is separately required by law. The Schedule carves out two narrow exceptions from this clock: data needed to let the Data Principal access her own user account, and any virtual token issued by or on behalf of the platform that's stored on it and usable to obtain money, goods or services. Everything else covered by the specified purpose falls under the three-year rule once it applies at all.

The 48-hour warning — Rule 8(2)

Before that period completes, the Data Fiduciary has to tell the Data Principal, at least forty-eight hours ahead, that her data will be erased at the end of the period unless she logs into her user account, otherwise initiates contact for the specified purpose, or exercises her rights over that processing. This is a genuine notice obligation, not a formality — a platform relying on Rule 8's erasure timeline without building this 48-hour warning into its systems is erasing data non-compliantly, regardless of whether the underlying three-year clock was tracked correctly.

The separate one-year floor — Rule 8(3)

Independent of sub-rules (1) and (2), every Data Fiduciary — not just the classes named in the Third Schedule — has to retain personal data, associated traffic data, and other processing logs for a minimum of one year from the date of processing, for the purposes listed in the Seventh Schedule, unless a longer period is required by other law or notified by the Government. After that year, the Data Fiduciary has to cause that data and those logs to be erased. This runs on its own timeline, separate from and in addition to whatever the Third Schedule requires for the named large platforms.

Why this matters in practice

The Third Schedule is easy to mistake for guidance because it reads like a technical annexure, but the Rules treat it as a statutory erasure deadline, not a best practice a platform can approximate. For an entity that meets one of the three thresholds, retaining data beyond the three-year window without a separate legal basis is unlawful by default, not merely risky — which means the first real question is entity classification: does your registered-user count actually cross two crore or fifty lakh, and does your erasure architecture actually fire on that boundary automatically, or does someone have to remember to run it manually.

Illustration one: X buys an e-book on platform Y. Once delivery completes, that specified purpose is served — but Y still has to retain the order details, personal data, and processing logs for at least one year from the transaction under Rule 8(3), even if X deletes her account the next day. Illustration two: company X engages cloud provider C, a Data Processor, to host customer records. X, as the Data Fiduciary, has to ensure C also retains that data and its logs for at least one year before erasure — the one-year floor travels with the data to whoever is actually processing it, not just to the Data Fiduciary's own systems.

How Rule 8 connects to the rest of the Rules and the Act

Rule 8 operationalises Sections 8(7), 8(8) and 8(11) of the Act — the last of which clarifies that a Data Principal who initiates no contact at all during a given period is deemed not to have approached the Fiduciary during it, which is what starts the Third Schedule's clock running in the first place. Rule 2(1)(c)'s "user account" definition decides what counts as the Data Principal "logging in" for purposes of resetting that clock, and Rule 7's breach-notification duty interacts with Rule 8 indirectly — data retained past the point it's needed is data exposed in a breach that better retention discipline would have avoided.