Businesses collect personal information, financial records, employee documents, customer communications and operational data every day. However, retaining information indefinitely can create privacy, security and regulatory risks. Data retention policies help organisations determine what information they should keep, why it is required, how long it should remain accessible and when it must be securely deleted. For businesses in India, an effective retention framework must balance privacy obligations under the Digital Personal Data Protection Act, 2023, statutory recordkeeping requirements, contractual commitments and legitimate operational needs. The objective is not simply to store less data. It is to retain the right information for a defensible period and dispose of it responsibly when the reason for keeping it ends.

What Are Data Retention Policies?

A data retention policy is a documented framework governing how an organisation stores, manages, archives and disposes of information throughout its lifecycle. It defines the principles for retaining records and establishes responsibilities for implementing those principles across business systems. A policy should explain the categories of information covered, the purpose of retention, applicable legal requirements, retention periods, deletion triggers and approved disposal methods. It should also identify who can approve exceptions and how the organisation will demonstrate compliance. A retention policy is different from a retention schedule. The policy establishes the overall rules, while the schedule assigns specific periods to categories such as customer records, invoices, employment documents, contracts, consent records, security logs and marketing data. Both are necessary because a general statement about retaining information only as long as necessary is difficult to implement without clear operational rules.

Why Do Businesses Need a Data Retention Policy?

Poor retention practices create risks in both directions. Deleting information too early can undermine tax reporting, contractual obligations, audits, investigations or legal claims. Keeping it too long can increase storage costs, expand the impact of a data breach and expose individuals to unnecessary privacy risks. A documented policy helps businesses identify which records must remain available and which can be removed. It also improves operational efficiency by reducing duplicate information and unnecessary storage. During an audit, investigation or customer dispute, a well maintained retention schedule helps the organisation locate relevant records and explain why they remain in its possession. Retention also supports accountability. If a business promises customers a defined retention period, its systems and internal procedures should reflect that promise. A policy which exists only as a document, without corresponding technical controls, offers limited practical protection.

Data Retention Requirements Under Indian Law

India does not prescribe one universal retention period for every category of business information. The applicable period depends on the record, the organisation, the relevant law and the purpose for which the information is retained. The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data. Section 8 addresses the responsibilities of Data Fiduciaries, including erasure when consent is withdrawn or the specified purpose is no longer served, subject to applicable legal requirements and exceptions. The Act and Rules also provide for specific retention and erasure obligations.

The DPDP Rules, 2025 introduce further detail through Rule 8 and the Third and Seventh Schedules. Rule 8 addresses when a specified purpose is deemed no longer served for certain classes of Data Fiduciaries and purposes. It also provides for a minimum one year retention period for specified personal data, associated traffic data and processing logs, subject to the Rule's conditions and exceptions. These substantive requirements are scheduled to commence 18 months after publication of the Rules, generally on 13 May 2027. Businesses should therefore distinguish between requirements already in force and future obligations for which preparation is necessary. The official DPDP Rules, 2025 published by MeitY provide the relevant statutory text and commencement schedule.

Other laws can require longer retention periods for particular records. For example, Section 128 of the Companies Act, 2013 generally requires companies to preserve books of account and relevant vouchers for at least eight financial years, subject to the statutory provisions and exceptions. GST law also contains record retention requirements. Section 36 of the Central Goods and Services Tax Act generally requires relevant accounts and records to be retained for 72 months from the due date for furnishing the annual return for the relevant year, with additional requirements where proceedings or investigations are pending. Businesses should map these obligations to the records concerned rather than apply one period to all company information.

How the DPDP Framework Affects Data Retention

The DPDP framework makes purpose and accountability central to personal data governance. Businesses should be able to explain why personal data is retained and identify when the purpose has been fulfilled. Retention should not continue merely because storage is inexpensive or a system has no automatic deletion setting. The position requires careful assessment because privacy obligations and statutory recordkeeping duties may overlap. A business may need to delete personal information after its operational purpose ends, while another applicable law may require certain transaction records to remain available. In such cases, the organisation should identify the precise legal requirement, retain only the information necessary to meet it and restrict access where appropriate.

Businesses should also prepare for the phased commencement of the DPDP framework. A retention policy adopted now should be reviewed against the applicable commencement notifications, the Rules and any subsequent amendments or clarifications. Treating future requirements as already fully operative can be misleading, but ignoring them during system design can make later compliance costly.

How to Create an Effective Data Retention Policy

The first step is to prepare a data inventory. Businesses should identify the information they collect, the systems holding it, the people responsible for it and the purposes for which it is used. The inventory should include cloud platforms, customer relationship management systems, employee databases, email accounts, analytics tools, shared drives, archives and third party applications. Information held by vendors should not be overlooked simply because it is outside the organisation's own infrastructure.The next step is to identify the legal, contractual and operational requirements for each category. Legal and compliance teams should determine whether a statute requires a minimum period, whether a contract creates a preservation obligation and whether an investigation or dispute requires information to be retained. Business teams should then explain any continuing operational need. Each category should have a defined retention trigger. For example, the period may begin when a contract expires, an employee leaves, an invoice is issued, a transaction is completed or a customer account closes. The schedule should state the duration and the action required when the period ends. “Retain for five years” is incomplete unless the organisation knows when those five years begin. The policy should also assign responsibility. Legal, finance, HR, information security, IT and business owners may control different records. A named policy owner should coordinate changes, approve exceptions and ensure retention rules are implemented consistently.

Choosing the Correct Retention Period

There is no universal retention period suitable for every business record. The correct period depends on applicable legislation, the purpose of processing, contractual commitments, limitation periods, audit needs and the risk associated with keeping the information. Financial records may need to be retained to meet accounting and tax obligations. Employee records may need different periods depending on the type of document and applicable employment requirements. Customer profiles, marketing leads and website analytics may require shorter, purpose based periods. Security logs may need to remain available for investigations and compliance with applicable cyber security requirements. Businesses should avoid copying retention schedules from unrelated organisations or adopting indefinite retention by default. Each period should have a documented rationale. Where several laws apply, the organisation should identify the relevant minimum requirements and resolve any conflict through an appropriate legal review.

Secure Deletion, Archiving and Backups

A retention policy must explain what happens when the authorised period ends. Depending on the record and applicable requirements, the organisation may securely delete it, anonymise it or preserve it under a documented legal exception. Pseudonymisation alone does not necessarily remove information from privacy law if a person can still be identified using additional information. Archiving is not the same as deletion. Moving old records to a separate storage system may reduce costs or restrict access, but the information still exists and may remain subject to applicable retention obligations. Similarly, deleting a record from a live database does not necessarily remove copies held in backups, email systems, analytics platforms or vendor environments. Businesses should define backup rotation periods and restrict access to archived information. Where immediate removal from backups is not technically feasible, the organisation should document how copies expire, how restored systems handle previously deleted information and how legal requirements are met. Secure disposal should cover both electronic records and physical documents, including appropriate destruction of storage media where necessary.

Managing Legal Holds and Investigations

Routine deletion must not undermine a legal obligation to preserve evidence. Litigation, regulatory investigations, audits or reasonably anticipated disputes may require an organisation to suspend normal deletion for relevant records. A legal hold procedure should identify who can issue the hold, which records and systems are covered, who must preserve them and who can authorise release. The organisation should record the reason for the hold and review it periodically. A legal hold should not automatically stop deletion across the entire business. It should apply to the information relevant to the matter. Once the hold is formally released, the normal retention schedule can resume, provided no other preservation requirement remains.

Data Retention in Employment and Customer Records

Employee records often include identity documents, payroll details, performance reviews, attendance information, benefits records and disciplinary documents. These categories may be subject to different legal and operational requirements. HR teams should therefore avoid applying one retention period to every employee file. Recruitment records for unsuccessful candidates, for example, may require a different approach from payroll and statutory employment records. Customer information also needs careful classification. Transaction records, account credentials, support conversations, marketing preferences and consent evidence serve different purposes. Closing a customer account does not necessarily mean every record must be deleted immediately, but it also does not justify keeping all information indefinitely. Businesses should identify which records must remain for legal or contractual reasons and remove unnecessary personal data when the applicable conditions are met.

Third Party Vendors and Data Retention

Outsourcing does not remove the need to manage retention. Cloud providers, payroll vendors, customer support platforms and analytics services may hold copies of personal data on behalf of a business. Contracts should specify permitted retention, secure deletion, backup handling, subcontractor controls and confirmation of disposal where appropriate. The organisation should also verify whether the vendor uses information for independent purposes. A vendor may retain certain records under its own legal obligations, but the arrangement should be understood and documented. Retention promises in customer facing privacy notices should align with the actual behaviour of the business and its providers.

Common Data Retention Mistakes

A common mistake is using a single retention period for all data. Another is treating a policy as complete without confirming whether deletion actually happens in production systems, archives, backups and third party platforms. Businesses may also forget to suspend deletion when a legal hold applies or fail to restart normal disposal once the hold ends. Indefinite retention is another concern. It should be supported by a clear legal or operational reason, not simply by convenience. Policies also become outdated when laws change, new systems are introduced or the business begins processing additional categories of personal data. Regular reviews and documented approvals help prevent these failures. For organisations seeking to improve governance, a data privacy compliance law firm can assist with identifying applicable retention obligations, reviewing privacy documentation, assessing vendor contracts and aligning the retention schedule with Indian data protection requirements.

How Businesses Can Maintain Ongoing Compliance

A retention programme should be reviewed periodically and whenever a significant legal, technical or business change occurs. Organisations should test whether automated deletion rules work as intended, check whether vendors follow contractual requirements and verify whether records subject to legal holds remain preserved. Evidence of implementation can include approved retention schedules, system configurations, deletion logs, vendor confirmations, audit findings and records of exceptions. These materials help demonstrate that the organisation has moved beyond policy drafting to practical enforcement. Corporate lawyers for businesses can also help assess how recordkeeping duties interact with commercial contracts, employment matters, tax requirements and disputes. The goal is to create a consistent approach which preserves records when necessary and prevents unjustified retention.

Conclusion

Data retention policies are essential for responsible information management. They help businesses preserve records required by law, maintain evidence for legitimate business needs and reduce risks associated with excessive storage. An effective framework begins with a reliable data inventory, maps legal requirements to specific records, establishes clear retention triggers and assigns responsibility for secure disposal. For Indian organisations, the DPDP Act and Rules must be considered alongside company, tax, employment, contractual and sector specific requirements. The phased commencement of the DPDP framework makes advance preparation particularly important. Businesses should review their systems, document retention decisions, manage legal holds, control third party retention and test whether deletion procedures work in practice. A well implemented policy does more than support compliance: it creates a disciplined, secure and accountable approach to the entire information lifecycle.

Frequently Asked Questions (FAQs)

Q1. What is the purpose of a data retention policy?

A data retention policy defines how long an organisation keeps information, why it needs it and what happens when the retention period ends. It helps balance legal recordkeeping duties, operational needs, privacy and security.

Q2. Is a data retention policy mandatory in India?

Specific recordkeeping obligations apply under several Indian laws, while the DPDP framework establishes personal data processing, erasure and retention requirements subject to phased commencement. A written policy is a practical way to identify and manage these obligations, even where a particular law does not prescribe a standalone policy document.

Q3. How long should businesses retain personal data?

The period depends on the purpose, applicable law, contractual obligations and any legal hold. Businesses should avoid adopting one universal period for every category of personal data.

Q4. Does the DPDP Act require businesses to delete personal data?

The Act addresses erasure when the purpose is no longer served or consent is withdrawn, subject to applicable legal requirements and exceptions. The detailed Rule 8 framework includes specific conditions and scheduled commencement, so businesses should assess the relevant provisions before setting their deletion procedures.

Q5. What is the difference between data retention and data backup?

Retention determines how long information should exist for an approved purpose. Backup creates copies to restore information after loss or system failure. Backup copies need their own lifecycle controls and should not become a reason for indefinite retention.

Q6. Can a business retain data after a customer closes an account?

Potentially. Certain records may need to be retained for tax, accounting, contractual or legal reasons. The organisation should document the reason, restrict access where appropriate and delete information once continued retention is no longer justified.

Q7. How often should a data retention policy be reviewed?

Businesses should establish a regular review cycle and reassess the policy when laws change, new systems are introduced, vendors change or business purposes are modified. Significant incidents and audit findings may also require updates.

This update was released on 13 Oct 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.