Rule 8 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 8(1) and (2) and the Third Schedule set a clock for three classes of large platforms. If a Data Principal has not approached the Data Fiduciary or exercised her rights for three years, the data is to be erased, after a warning at least forty-eight hours before the period ends.
Rule 8 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. It applies to three classes: an e-commerce entity with not less than two crore registered users in India, an online gaming intermediary with not less than fifty lakh, and a social media intermediary with not less than two crore. Personal data is erased after the three-year period unless a law requires retention, and the Data Principal is told at least forty-eight hours before. Rule 8(3) is covered separately.
Rule 8 and the Act
Section 8(7) of the Act requires a Data Fiduciary to erase personal data when consent is withdrawn or the specified purpose is no longer served, unless retention is necessary for compliance with law. Rule 8 supplies the periods after which, for three classes, the purpose is treated as no longer served. Its heading reads "Time period for specified purpose to be deemed as no longer being served". The Act's text is in Section 8 of the DPDP Act: erasure and retention of personal data.
Rule 1(4) places rule 8 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Third Schedule follows rule 8. See rules 1 and 2.
Platforms near these thresholds often need to map their user base to the classes before deciding how to build deletion workflows, and a legal consultation is a sensible first step.
Rule 8(1): who erases what, and when
A Data Fiduciary "who is of such class and is processing personal data for such corresponding purposes as are specified in Third Schedule, shall erase such personal data". Two exceptions appear in the sentence: where "its retention is necessary for compliance with any law for the time being in force", and the case of the Third Schedule's period when the Data Principal "neither approaches such Data Fiduciary for the performance of the specified purpose nor exercises her rights in relation to such processing".
Drafting note: the sentence is awkwardly worded. Read with the Third Schedule and sub-rule (2), it works like this: the Data Fiduciary erases the data when the Schedule's period passes without the Data Principal approaching it for the specified purpose or exercising her rights; retention needed for another law is kept clear of erasure.
The Third Schedule
| S. no. | Class of Data Fiduciary | Purposes | Time period |
|---|---|---|---|
| 1 | An e-commerce entity having not less than two crore registered users in India | All purposes, except (a) enabling the Data Principal to access her user account and (b) enabling access to a virtual token (see below) | Three years from the date on which the Data Principal last approached the Data Fiduciary for the performance of the specified purpose or exercise of her rights, or the commencement of the Digital Personal Data Protection Rules, 2025, whichever is latest |
| 2 | An online gaming intermediary having not less than fifty lakh registered users in India | Same | Same |
| 3 | A social media intermediary having not less than two crore registered users in India | Same | Same |
The two excepted purposes
Column (3) says "For all purposes, except for the following": (a) "Enabling the Data Principal to access her user account"; and (b) "Enabling the Data Principal to access any virtual token that is issued by or on behalf of the Data Fiduciary, is stored on the digital facility or platform of such Data Fiduciary, and may be used to get money, goods or services".
So the three-year erasure applies to everything else. A user's login and a stored wallet balance or token are outside the Schedule's period.
The clock
"Three years from the date on which the Data Principal last approached the Data Fiduciary for the performance of the specified purpose or exercise of her rights, or the commencement of the Digital Personal Data Protection Rules, 2025, whichever is latest." Two points:
- The three years restart each time the Data Principal approaches the Data Fiduciary or exercises her rights. A customer who buys something once every two years never reaches the erasure date.
- The period runs from the later of two dates. One of them is "the commencement of the Digital Personal Data Protection Rules, 2025".
Drafting notes: rule 1 gives three commencement dates (publication; one year; eighteen months) and the Schedule does not say which it means, so no start date is chosen here. Also, "whichever is latest" is used for two alternatives, where "later" is the usual word.
The definitions in the Note
- (a) "e-commerce entity": any person who owns, operates or manages a digital facility or platform for e-commerce as defined in the Consumer Protection Act, 2019 (35 of 2019), but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity as defined in the said Act. We describe nothing from inside that Act; for context see e-commerce under the Consumer Protection Act, 2019.
- (b) "online gaming intermediary": any intermediary who enables the users of its computer resource to access one or more online games.
- (c) "social media intermediary": an intermediary as defined in clause (w) of sub-rule (1) of rule 2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. That reference is quoted, not described.
- (d) "user": for an e-commerce entity, any person who accesses or avails any computer resource of it; for an online gaming or social media intermediary, any person who accesses or avails of any computer resource of an intermediary for the purpose of hosting, publishing, sharing, transacting, viewing, displaying, downloading or uploading information.
The thresholds speak of "registered users". The Schedule does not say how or when the number is counted, and the Rules are silent on whether the figure is read at any particular date.
Rule 8(2): the forty-eight-hour warning
"At least forty-eight hours before completion of the time period for erasure of personal data under this rule, the Data Fiduciary shall inform the Data Principal that such personal data shall be erased upon completion of such period, unless she logs into her user account or otherwise initiates contact with the Data Fiduciary for the performance of the specified purpose or exercises her rights in relation to the processing of such personal data."
The warning must say three things: the data will be erased; when (on completion of the period); and what stops it (logging in, contacting the Data Fiduciary for the specified purpose, or exercising rights). "User account" has the meaning in rule 2(1)(c).
Example
ShopSphere, an invented marketplace platform, has three crore registered users in India. A customer, Meera, last bought something and last logged in on a given day. At least forty-eight hours before three years from that day, ShopSphere tells her that her order history will be erased unless she logs in or contacts it. She does nothing, and the data is erased, apart from what another law requires it to keep. Her wallet balance, being a virtual token that can be used to get goods, is outside the Schedule's period. The Rules' only Illustration for rule 8 is on sub-rule (3), covered in our article on the one-year retention rule; the example above is ours.
For a context article written before the Rules, see DPDP Act for e-commerce companies.
Need help with erasure policies?
Retention schedules, deletion workflows and user warnings all have to line up with the Third Schedule if you are in one of its classes. Speak to our legal team about mapping your user numbers and data flows.
Key takeaways
- Rule 8 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- Three classes: e-commerce entity (two crore registered users in India), online gaming intermediary (fifty lakh), social media intermediary (two crore).
- Three years run from the last approach or exercise of rights, or the commencement of the Rules, whichever is latest.
- Access to the user account and to virtual tokens are excepted purposes.
- A warning is due at least forty-eight hours before the period ends.
- Legal retention duties override erasure.
- Later amendments and notifications should be checked.
Read next
- Rule 8(3): one-year retention of personal data, traffic data and logs
- Rule 23 and the Seventh Schedule
- Section 8 of the DPDP Act: erasure and retention of personal data
- Section 12 of the DPDP Act: right to correction and erasure
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.