What are the data retention and erasure rules for large platforms under the DPDP Rules, 2025?
Answer:
The Third Schedule requires certain large Data Fiduciaries to erase personal data after three years from the last activity of the Data Principal (or from commencement of the rule), unless retention is required by law. This applies to e-commerce entities and social media intermediaries with at least 2 crore registered users, and online gaming intermediaries with at least 50 lakh registered users. The platform must give the user at least 48 hours notice before erasure.
data retention three years erasure ecommerce gaming social media 48 hours
Related Questions:
- By when do organizations need to technically integrate with Board-registered Consent Managers?
- Is the consent notice required to give contact details?
- What makes consent valid under Section 6 of the DPDP Act?
- Must a Data Fiduciary maintain data accuracy?
- What is the right to correction and erasure?
- How are DPDP penalties determined by the Board?