SCENARIO S06 · RETENTION & ERASURE
A deleted account disappears from production but personal data remains indefinitely in restorable backups. What needs review?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Document erasure, legal retention, backup expiry and what happens if an old backup is restored.
Backups need an expiry and restoration playbook so erased data is not silently reintroduced, while lawful retention is recorded rather than guessed.
WHY THE OTHER INSTINCTS MISS
Document erasure, legal retention, backup expiry and what happens if an old backup is restored.
Correct. The operational plan must reconcile future Act section 8(7) erasure with applicable retention requirements, including future Rule 8(3).
Call the account deleted because the primary row is gone.
Restorable personal data remains part of the real system state and needs a controlled lifecycle.
Delete every backup immediately, including required security logs.
The framework can require retention for other law and, when operative, specified Rules purposes. Automatic destruction can also be wrong.
BUILD THIS EVIDENCE
Backup schedule, legal-retention map, deletion tombstone and restoration re-erasure procedure.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- fact-dependent
- Pinpoint
- Act s. 8(7); Rule 8(3) and Seventh Schedule; G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)