SCENARIO F06 · RETENTION & ERASURE
Old customer records are moving into a new CRM. The team assumes the migration itself decides whether processing may continue. What should happen?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Record the processing facts and basis; if relying on pre-commencement consent, plan the Act section 5(2) notice and withdrawal path.
Do not turn a system migration into a made-up legal rule. Use it as a checkpoint to document the actual history, purpose, notice and retention facts.
WHY THE OTHER INSTINCTS MISS
Record the processing facts and basis; if relying on pre-commencement consent, plan the Act section 5(2) notice and withdrawal path.
Correct. Act section 5(2) addresses consent given before commencement; a migration review is useful implementation evidence, not the statutory trigger itself.
Delete every old record before the CRM migration.
The Act does not create that automatic answer. Purpose, consent history, other law and retention facts matter.
Import everything because old consent can never be questioned.
Section 5(2) includes a post-commencement notice, and continued consent-based processing remains subject to withdrawal.
BUILD THIS EVIDENCE
Legacy-data inventory, consent/notice history, retention decision and post-commencement notice plan.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act s. 5(2), including illustration; G.S.R. 843(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)