Section 8 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 8(7) requires a Data Fiduciary to erase personal data when the Data Principal withdraws consent, or once it is reasonable to assume the specified purpose is no longer served, whichever is earlier, unless retention is necessary to comply with a law. Sub-sections (8) and (11) explain when a purpose is deemed no longer served. A legal consultation can help set retention rules that match your legal record-keeping duties.
A Data Fiduciary must erase personal data on withdrawal of consent or when it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, and must cause its Data Processor to erase data it made available (section 8(7)). The exception is where retention is necessary for compliance with any law in force. A purpose is deemed no longer served if the Data Principal neither approaches the fiduciary nor exercises any right for a prescribed period (section 8(8)). Breach falls under the fifty crore rupee ceiling.
Sub-sections (7), (8) and (11) at a glance
| Sub-section | Rule |
|---|---|
| 8(7)(a) | Erase personal data on withdrawal of consent, or when the specified purpose is reasonably assumed no longer served, whichever is earlier |
| 8(7)(b) | Cause the Data Processor to erase personal data made available to it |
| 8(7) opening words | Unless retention is necessary for compliance with any law for the time being in force |
| 8(8) | Purpose deemed no longer served if the Data Principal does not approach the fiduciary for the specified purpose and does not exercise any right, for the prescribed period; different periods for different classes and purposes |
| 8(11) | Clarification of "not approached": no initiation of contact for the purpose, in person or by electronic or physical communication, during the period |
Section 8(7)(a): two triggers, whichever is earlier
The obligation is triggered by the earlier of:
- withdrawal of consent by the Data Principal; or
- the point at which it is reasonable to assume that the specified purpose is no longer being served.
"Specified purpose" is defined in section 2(za) as the purpose mentioned in the notice given under the Act. So the notice you gave under section 5 sets the benchmark for when the purpose ends. A vague notice therefore makes retention harder to defend. See section 5.
The text of section 8(7) speaks of "consent" in the trigger and there is no separate trigger listed for processing based on section 7's certain legitimate uses, where consent is not the basis. For that data, the second trigger, end of the specified purpose, is the one to watch. The Act is silent on whether other situations require erasure; do not stretch the text.
The legal retention exception
The obligation applies "unless retention is necessary for compliance with any law for the time being in force". Two features matter:
- The test is necessity, not convenience. A business desire to keep data for analytics or possible future marketing is not a legal requirement.
- The law can be any law in force, for example tax, company, banking or labour record-keeping statutes. The Act does not name them. Identify the specific provision and the period it requires, and keep only what it requires.
The Illustrations
The Act gives two.
Illustration (I). X registers on an online marketplace operated by Y and consents to processing of her personal data for selling her used car. The marketplace helps conclude the sale. Y shall no longer retain her personal data. The purpose is served, so the data has to go.
Illustration (II). X closes her savings account with Y, a bank. Law applicable to banks requires Y to keep the record of the identity of its clients for ten years beyond closing of accounts. Since retention is necessary for compliance with law, Y shall retain X's personal data for that period.
Illustration (II) is limited: the bank keeps the identity records the law requires, for the period the law requires. It does not say the bank may keep every data point for that time.
Section 8(7)(b): processors must erase too
The fiduciary must "cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing". Again, responsibility sits with the fiduciary. The vendor contract should contain an erasure instruction clause and a confirmation step. See section 8(1) and (2).
Section 8(8) and (11): when a purpose is deemed no longer served
Section 8(8) creates a deemed rule. The purpose is deemed no longer served if the Data Principal does not:
- (a) approach the Data Fiduciary for performance of the specified purpose; and
- (b) exercise any of her rights in relation to that processing,
"for such time period as may be prescribed". The Act adds that different periods may be prescribed for different classes of Data Fiduciaries and different purposes. The period itself is left to the Rules and is not in the Act. The DPDP Rules, 2025 (notified November 2025) prescribe the detail, and different provisions commence on different dates; check the Rules. This article states no period.
Both limbs need to be met (the word "and" joins them). If she logs in but does not use the service, or if she sends a rights request, the facts need to be tested against the two limbs.
Section 8(11) is a clarification: a Data Principal is considered as not having approached the fiduciary in any period in which she has not initiated contact with it for that performance, "in person or by way of communication in electronic or physical form". Contact initiated by the business, such as a promotional email or a reminder, does not count as her approaching it. That is the plain reading of "has not initiated contact".
Who this applies to
- All Data Fiduciaries, subject to exemptions. Under section 17(3) the Central Government may notify Data Fiduciaries or classes, including startups, for whom sub-sections (3) and (7) of section 8 do not apply.
- Under section 17(4), for processing by the State or an instrumentality of the State, sub-section (7) of section 8 and sub-section (3) of section 12 do not apply.
- In the situations listed in section 17(1), Chapter II other than sub-sections (1) and (5) of section 8 does not apply.
Consequence of breach
The Schedule has no separate entry for section 8(7). Item 7 covers breach of any other provision: penalty may extend to fifty crore rupees. The Board imposes it only after an inquiry, a hearing and a finding that the breach is significant (section 33(1)), weighing section 33(2). See penalties.
Practical examples
Example 1: marketplace listing. A seller's listing is completed and the sale concluded. Illustration (I) indicates the marketplace should no longer retain the data tied to that purpose.
Example 2: withdrawn newsletter. A subscriber withdraws consent. Section 6(6) requires stopping processing; section 8(7)(a) requires erasure, unless a legal retention duty covers some of the data. See withdrawal of consent.
Example 3: dormant account. A customer has not used an app or contacted the company for a long time. Whether the purpose is deemed no longer served depends on the period prescribed under section 8(8), which is in the Rules.
Common mistakes
- Keeping data "in case we need it".
- Forgetting to tell processors to erase.
- Retaining everything because one record has to be kept by law.
- Treating marketing contacts sent by the business as proof the customer is active.
- Having no schedule of retention periods by data type.
Need help with retention and erasure rules?
A retention schedule links each type of data to its purpose and to any law that requires it to be kept. You can work through this with us under our legal consultation service, including how to instruct your vendors.
Key takeaways
- Erase on withdrawal of consent or when the specified purpose is reasonably assumed to be served, whichever is earlier.
- Keep only what a law in force makes necessary to retain.
- Make your Data Processors erase as well.
- The inactivity period in section 8(8) is for the Rules; the Act states none.
- There is no specific Schedule entry; Rs 50 crore is the ceiling for other provisions.
Read next
- Section 6 of the DPDP Act, 2023: withdrawal of consent
- Section 12 of the DPDP Act, 2023: right to correction and erasure
- Section 8 of the DPDP Act, 2023: contact information and grievance redressal
- DPDP compliance checklist for businesses
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.