Employee personal data retention and erasure schedule
A single format from the Employee Personal Data under the DPDP Act pack. s.8(7), DPDP Act 2023 · Rule 8(3), DPDP Rules 2025 · Rule 51(4), CW (Central) Rules 2026 · s.128(5), Companies Act 2013 · CERT-In Directions 2022.
- 8 pages
- 76
- Word and PDF
- 30 October 2026
- 30 October 2026
What it covers
- 1Employee personal data retention and erasure schedules.8(7), DPDP Act 2023 · Rule 8(3), DPDP Rules 2025 · Rule 51(4), CW (Central) Rules 2026 · s.128(5), Companies Act 2013 · CERT-In Directions 2022
Not included
What you will still need outside this format:
- Data processing agreements with payroll, HR and verification vendors (Data processing agreement pack)
- The website and app privacy policy for customers and visitors
- A DPDP readiness assessment of the Company's systems and vendors
- Obligations of a Significant Data Fiduciary (Data Protection Officer, impact assessment, data audit) and Consent Manager registration
- Technical implementation of security safeguards, erasure and breach reporting to the Data Protection Board and CERT-In
- Advice on a particular grievance or a complaint before the Data Protection Board
Read the opening
The first part of the format, as it downloads. Blanks are highlighted.
How the schedule works. Section 8(7) of the DPDP Act 2023 requires personal data to be erased, and Data Processors to be made to erase it, once the purpose is no longer served, unless retention is necessary to comply with a law; from 13.05.2027 Rule 8(3) also requires the personal data, traffic data and logs of any processing to be kept for at least one year from the processing, for the State purposes in the Seventh Schedule, and then erased unless a law requires otherwise. Each row below states the longer of the statutory period and the period the Company needs for its purpose and for claims, with the claims period in mind (generally three years under the Limitation Act 1963, and three years for claims under s.45 of the Code on Wages 2019). Rule 8(1) and (2), with the forty-eight hour notice before erasure, apply only to the classes in the Third Schedule (large e-commerce, online gaming and social media intermediaries) and not to an employer's records. Periods in square brackets are policy periods for the Company to confirm; a period stated without brackets is the statutory minimum as verified when this format was stated on 30.10.2026.
[Name of the Company] · Employee personal data retention and erasure schedule · Version [Version number of the schedule] · Approved by [Approving authority for the schedule] on [Date of approval of the schedule]
Applies to: all personal data of candidates, employees, former employees, trainees, interns and apprentices, and of the family members, nominees and emergency contacts whose details they give, held by the Company or by its Data Processors in any form.