Rule 8 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 8(3) goes the opposite way from erasure. It tells a Data Fiduciary to keep personal data, associated traffic data and other logs of processing for a minimum of one year from the date of processing, for the purposes in the Seventh Schedule, and then to erase them unless another law requires further retention.
Rule 8 is in the group that, under rule 1(4), comes into force eighteen months after the date of publication of the Gazette. Without prejudice to sub-rules (1) and (2), a Data Fiduciary retains personal data, associated traffic data and other logs of any processing, including by a Data Processor on its behalf, for a minimum period of one year from the date of such processing, for the purposes in the Seventh Schedule. After that it causes erasure, unless further retention is required by other law.
Rule 8(3) and the Act
The Act's erasure and retention duty is covered in Section 8 of the DPDP Act: erasure and retention of personal data. Sub-rules (1) and (2) of rule 8, with the three-year clock and the Third Schedule, are in our article on erasure after three years. This article deals only with sub-rule (3).
Rule 1(4) puts rule 8 in the group that comes into force "eighteen months after the date of publication of this Gazette". Counting from the Gazette date of 13 November 2025, eighteen months end in mid-May 2027; confirm the exact date of publication before relying on a date. The Seventh Schedule, to which rule 8(3) points, follows rules 23 and 8(3). See rules 1 and 2.
A retention duty touches contracts with cloud and software vendors, and a legal due diligence review of those contracts shows whether they already carry the one-year requirement.
What the sub-rule says
"Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government."
Taking it apart:
| Element | Text |
|---|---|
| Who | "a Data Fiduciary" (every Data Fiduciary; not limited to the Third Schedule classes) |
| What | "such personal data, associated traffic data and other logs of the processing" |
| Which processing | "any processing of personal data undertaken by it or on its behalf by a Data Processor" |
| How long | "a minimum period of one year from the date of such processing" |
| Why | "for the purposes as specified in the Seventh Schedule" |
| Afterwards | "cause such personal data and logs to be erased" |
| Unless | "further retention is required for compliance with any other law for the time being in force or notified by the Government" |
Every Data Fiduciary
Sub-rule (3) says "a Data Fiduciary", with no class or user threshold. The three-year erasure in sub-rule (1) is restricted to the Third Schedule's classes; this sub-rule is not. "Without prejudice to sub-rules (1) and (2)" means those sub-rules are left untouched. A large platform may therefore have data that must be kept for at least a year under sub-rule (3) and erased after three years of inactivity under sub-rule (1).
What is kept
Three things: the personal data, "associated traffic data" and "other logs of the processing". The Rules do not define "traffic data". The Illustration gives examples of logs: "order confirmation, payment, and delivery events". A Data Fiduciary should treat the phrase as covering records that show how and when the data was processed, and take advice on edge cases because the text is silent.
The one-year minimum
"A minimum period of one year from the date of such processing." The year runs from each act of processing, not from the date the account closed, so data from a transaction in March can be erased after the next March, while data from a later transaction runs on its own year. The word "minimum" means that the Rule sets a floor. The sub-rule itself names one ground for keeping data beyond the year: further retention required for compliance with any other law for the time being in force or notified by the Government.
The Seventh Schedule purposes
Retention is "for the purposes as specified in the Seventh Schedule". The Schedule lists three purposes, each with an authorised person, and it also serves rule 23. In summary the purposes are use by the State or its instrumentalities in the interest of the sovereignty and integrity of India or security of the State; use by the State for performance of a function, or disclosure to fulfil an obligation, under law; and an assessment for notifying a Significant Data Fiduciary. They are explained in our article on rule 23 and the Seventh Schedule.
After the year
Once the minimum has passed the Data Fiduciary "shall cause such personal data and logs to be erased". The verb "cause" matters when a Data Processor holds the data: the Data Fiduciary must see that the Data Processor erases it too. The exception is "further retention ... required for compliance with any other law for the time being in force or notified by the Government".
The Rules' own Illustration
Case 1: X purchases an e-book on an e-book platform Y. Once delivery is completed, the specified purpose of processing is served. Y "must retain the order details, personal data, and logs of the processing (such as order confirmation, payment, and delivery events) for at least one year from the date of the transaction, even if X deletes her account."
Case 2: X, a company, engages a cloud service provider C as its Data Processor to host customer records. X as the Data Fiduciary "is required to ensure that the C also retains the data and associated logs for at least one year before erasure, unless any other applicable law requires a longer period."
Case 1 shows that a user's deletion of her account does not end the one-year duty. Case 2 shows that the duty reaches the vendor, and that the Data Fiduciary has to ensure it.
Our own example, separate from the Illustration: a ride-booking app, RideNow (invented), completes a trip in June. Even after the rider deletes her account in July, RideNow must keep the trip records and processing logs for at least one year from the date of the trip, and its Data Processor must too.
Compare rule 6(1)(e)
Rule 6(1)(e) also uses one year, for logs and personal data kept to detect and investigate unauthorised access; see rule 6 on security safeguards. The purposes differ (security, against the Seventh Schedule purposes here), so a business should treat the two as separate duties that may overlap in practice. The Rules do not say that one satisfies the other.
For a vendor-side view, see our post on a data processing agreement under the DPDP Act.
Need help with retention schedules?
A retention schedule that works has to reconcile this rule, rule 6, the three-year clock and sector laws. Ask about legal due diligence to test your contracts and policies for the one-year requirement.
Key takeaways
- Rule 8 starts eighteen months after the date of publication of the Gazette (rule 1(4)).
- Personal data, associated traffic data and other logs of processing are kept for a minimum of one year from the date of processing.
- The duty covers processing by a Data Processor on the Data Fiduciary's behalf.
- The purposes are those in the Seventh Schedule.
- After the year, erasure follows unless another law requires further retention.
- Deleting an account does not end the duty (Illustration, Case 1).
- Later amendments and notifications should be checked.
Read next
- Rule 8(1) and (2): erasure after three years and the Third Schedule
- Rule 23 and the Seventh Schedule
- Rule 6: reasonable security safeguards
- Section 8 of the DPDP Act: erasure and retention
Disclaimer: Based on the Digital Personal Data Protection Rules, 2025 as notified in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), as consulted on 2 October 2026. The Rules come into force in three stages under rule 1; later amendments, notifications and anything published by the Data Protection Board of India should be checked. This article is general information, not legal advice; check the official text before acting.