SCENARIO M04 · RETENTION & ERASURE
A service keeps logs containing personal data but has no retention period. Which future Rules need checking?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Rule 6(1)(e) security logs and Rule 8(3)/Seventh Schedule processing records, plus any other law.
Classify the log and its purpose before assigning a period. Do not turn one schedule into a universal retention rule.
WHY THE OTHER INSTINCTS MISS
Rule 6(1)(e) security logs and Rule 8(3)/Seventh Schedule processing records, plus any other law.
Correct. Both future provisions use a one-year period in their stated contexts, with room for other-law requirements.
A universal seven-year period for every log.
The seven-year record rule in the First Schedule concerns a Consent Manager’s specified platform records, not every log.
Immediate deletion of every log after an incident closes.
That can conflict with the future minimum periods and other applicable law.
BUILD THIS EVIDENCE
Log taxonomy, applicable Rule/other-law basis, one-year trigger where relevant and deletion job evidence.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Rules 6(1)(e), 8(3) and Seventh Schedule; G.S.R. 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)