Section 8(7): Automatic Data Erasure & Downstream Vendor Purge

Statutory Text (Official Gazette)

Section 8(7): A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,—

(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and

(b) cause its Data Processor to erase any personal data that was made available by the Data Fiduciary for processing to such Data Processor.

What Section 8(7) Means in Plain English

Section 8(7) kills the common business practice of hoarding customer data forever “just in case we need it later.”

Under this clause, data retention is strictly limited:

1. Two Triggers for Mandatory Erasure:
   • Trigger A (User Withdrawal): The user revokes consent or deletes their account.
   • Trigger B (Purpose Completion): The specific business reason for collecting the data has finished (e.g. an order is delivered and the return window closes; the order records and logs still have to be kept for one year under Rule 8(3)).
2. The “Whichever is Earlier” Rule: Whichever trigger occurs first requires you to erase the data.
3. Rule 8 Inactivity Periods: Section 8(8) treats a purpose as over when the user has not come back for a prescribed period. Under the Third Schedule to the Rules, that is three years for e-commerce and social media platforms with at least 2 crore registered users in India and online gaming platforms with at least 50 lakh. You must warn the user at least 48 hours before erasing.
4. One-Year Minimum: Rule 8(3) requires you to keep personal data, traffic data and processing logs for at least one year from the date of processing before erasing them, even after an account is deleted.
5. The Processor Cascade: You must not only delete records from your own databases; you are legally obligated to instruct all your third-party vendors (AWS, Salesforce, HubSpot, Stripe) to erase their copies as well.

Statutory Exceptions: When Can You Keep Data?

You are not required to delete data if a separate Indian law specifically mandates retention, for example:

• Tax & Accounting: Invoices and transaction records under the Goods and Services Tax (GST) and Income Tax Act (typically retained for 6 to 8 years).
• Financial Compliance: Anti-money laundering (PMLA) and RBI KYC transaction records.
• Active Litigation: Records needed to defend an active legal claim before an Indian court or tribunal.

Engineering Implementation Checklist

• Automated Data Purge Cron Jobs: Build database retention scripts that identify and hard-delete customer records once their retention window expires.
• Outbound Erasure Webhooks: Implement automated webhooks that dispatch deletion events to third-party CRMs and marketing tools when a user account is deleted.
• Backup Scrubbing Policies: Establish formal database backup retention cycles so deleted data is permanently rolled off backup snapshots within a defined timeline.

← Back to Full Section 8: General Obligations