SCENARIO C04 · RETENTION & ERASURE
A business keeps purchase records forever “just in case.” Which question comes first?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Identify the purpose, other-law retention, and whether the Rule 8 Third Schedule class and threshold apply.
Build a scoped retention decision. Do not copy a threshold-specific warning workflow onto every organisation.
WHY THE OTHER INSTINCTS MISS
Identify the purpose, other-law retention, and whether the Rule 8 Third Schedule class and threshold apply.
Correct. Future Rule 8’s deemed-purpose periods and 48-hour warning are not universal; they apply to specified classes and purposes.
Send every customer a 48-hour deletion warning immediately.
That overgeneralises future Rule 8(2), which is connected to Rule 8(1) and the Third Schedule.
Keep everything because purchase records may someday be useful.
An undefined future possibility is not a retention schedule or a documented legal need.
BUILD THIS EVIDENCE
Purpose-by-record schedule, applicable-law register, Third Schedule assessment and deletion trigger.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act s. 8(7)–(8); Rule 8(1)–(2) and Third Schedule; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)