Retention Schedule Template

RETENTION SCHEDULE

Organization: [Organization Name]
Maintained By: [DPO / Data Governance Lead]
Approved By: [Name, Title]
Effective Date: [DD-MM-YYYY]

1. PURPOSE

Section 8(7) of the DPDP Act, 2023 requires a Data Fiduciary to erase personal data once the specified purpose is no longer being served and retention is not otherwise required by law, or when a Data Principal withdraws consent, whichever is earlier. This schedule sets the retention period and erasure trigger for each category of personal data processed by [Organization Name], and doubles as the operating reference for the automated or manual deletion workflow.

2. INSTRUCTIONS

Every data category listed in the Record of Processing Activities (ROPA) must have a corresponding entry here. Where a legal retention requirement exists (tax, labor, or other statute), cite it. Where no statutory minimum applies, retention must be justified by reference to the purpose stated in the notice given under Section 5.

3. SCHEDULE

Column headers: Data Category | Source / System | Purpose Served | Retention Period | Erasure Trigger | Legal Basis for Retention Period | Disposal Method | Owner

Example Row 1:
Data Category: Customer KYC documents
Source / System: Onboarding platform
Purpose Served: Identity verification for account opening
Retention Period: 5 years after account closure
Erasure Trigger: Account closure date + 5 years, or earlier statutory instruction
Legal Basis for Retention Period: Applicable KYC / financial record-keeping norms
Disposal Method: Secure deletion from primary and backup storage, verified by system log
Owner: [Compliance Lead]

Example Row 2:
Data Category: Marketing consent and preference data
Source / System: CRM
Purpose Served: Sending promotional communications
Retention Period: Until consent withdrawn, or 24 months of no engagement
Erasure Trigger: Withdrawal request logged in Rights Request Log, or inactivity threshold reached
Legal Basis for Retention Period: Purpose-limitation under Section 8(7); no statutory minimum applies
Disposal Method: Automated purge job, monthly
Owner: [Marketing Operations Lead]

Example Row 3:
Data Category: Job applicant data (unsuccessful candidates)
Source / System: Applicant tracking system
Purpose Served: Recruitment evaluation
Retention Period: 12 months from rejection
Erasure Trigger: Rejection date + 12 months
Legal Basis for Retention Period: Internal policy balancing potential future outreach against data minimization
Disposal Method: Automated purge job, quarterly
Owner: [Talent Acquisition Lead]

Example Row 4:
Data Category: Website server and access logs
Source / System: Web infrastructure
Purpose Served: Security monitoring, incident investigation
Retention Period: Minimum 1 year, aligned with security safeguard baselines under the DPDP Rules, 2025
Erasure Trigger: Rolling deletion after retention period, subject to active incident hold
Legal Basis for Retention Period: Security safeguard requirement
Disposal Method: Automated log rotation and deletion
Owner: [Security Lead]

4. LEGAL HOLD EXCEPTION

Where personal data is subject to an ongoing legal proceeding, regulatory inquiry, or Board directive, erasure must be suspended and the record flagged "Legal Hold" with a reference to the matter, reviewed at least quarterly by [Legal Team].

5. REVIEW CYCLE

This schedule is reviewed [annually / on material change to processing purposes] and approved by [DPO Name]. Last Reviewed: [DD-MM-YYYY]. Next Review: [DD-MM-YYYY].