Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Fintech & BFSIPayments & UPIUPIWalletsLendingBNPLLSPsKYCVideo-KYCAadhaar eKYCWealthtechInsurTechHealth insuranceDebt collectionsBanksNBFCsNGOsHealthcare & PharmaHospitalsDiagnostic labsGenetic testingPharmaClinical trialsTelemedicineE-commerce & RetailD2CMarketplacesLogisticsLoyalty & CRMGCCsSaaS & TechnologyAI & MLFoundation modelsB2B SaaSCloudDeveloper toolsEdTech & EducationSchoolsCoachingLMSProctoringChildren-directed appsGovernment & PSUe-GovernancePublic servicesUtilitiesManufacturingAutomotiveDealersIndustrialIoTMedia & EntertainmentAdTechGamingOTTPublishingSocial mediaBrowse all sectors
Implementation
All 17 DPDP servicesFintech & digital lendingGCC & global centresDPDP Compliance AssessmentFind where you stand and your gapsDPDP ImplementationTurn the rules into daily practiceData MappingKnow what data you hold, and whereRoPAYour record of processing activitiesPrivacy AuditIndependent check of your controlsDPO ServicesOutsourced or part-time DPOSDF ReadinessCheck for extra SDF dutiesConsent ManagementCapture, track and withdraw consentNotice & Consent RemediationFix notices and consent flowsData Principal RightsHandle access, correction, erasureRetention & DeletionWhat to keep, how long, how to deleteVendor & Processor ManagementControl third parties handling dataChildren's DataRules for handling minors' dataSecurity SafeguardsTechnical and organisational controlsBreach ResponseWhat to do when a breach happensPrivacy Operations SupportKeep the programme runningDPDP TrainingTrain staff, legal and leaders
Training
All DPDP Act trainingEmployee awarenessCorporate trainingLeadership briefingDPO and certification
Resources
Readiness assessmentGuidesBy roleGlossaryCompareNews
About
AboutEditorial policyContactFAQ
Readiness assessment

Free Excel register

DPDP Act Retention and Erasure Register (Free Excel)

An Excel register that links each category of personal data to its purpose, the event that starts the retention clock, the erasure trigger, every place a copy rests and the proof that it was removed. It is built to sit beside our guide to retention and erasure mapping.

  • 7 sheets
  • 40 rules, 60 locations, 60 erasure log rows
  • Gap flags are formulas
FREE XLSX

Get the free register

Free XLSX, about 30 KB. Link appears on the next page.

Free. Internal self-assessment aid, not certification or legal advice. If you do not get your download link, write to hi@dpdpactindia.in.

How to use the register in five steps

  1. Read the Example sheet. It follows six types of data at a fictional online store.
  2. On the Register sheet, add one row for each category of data and purpose. Fill the retention trigger first, then the rule and the driver. If a law requires retention, name the law and section.
  3. On the Locations sheet, add one row for every place a copy rests: production, replicas, backups, logs, spreadsheets, email, paper, laptops and vendor systems.
  4. When an erasure happens, add a row to the Erasure log. Check for a legal hold first, then record vendor confirmations and the evidence reference.
  5. Read the gap flags and the Summary sheet. Give each gap an owner and a date, and review each rule when a purpose, vendor, system or law changes.

Who it is for, and what it does not do

It suits privacy leads, records owners, IT and security teams and legal or finance reviewers who need one place to show why data is kept and how it leaves. It works best beside a personal data inventory and a processor register, because it uses the same activity IDs and processor IDs.

It does not tell you how long to keep any record. Real periods come from your own purpose and from the laws that apply to you, so set them with legal advice. A gap flag is a prompt to check, not a finding of non-compliance.

What the law says. The Act and the Rules contain no single retention period for all personal data. Section 8(7) requires a Data Fiduciary to erase personal data when the Data Principal withdraws consent or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless retention is necessary for compliance with law. We found no provision requiring a retention and erasure register. It is a practical tool.

Frequently asked questions

Does the register tell me how long to keep each type of data?

No. The Act and the Rules contain no single retention period for all personal data. Each rule in your register should come from your own specified purpose or from a named law. The periods in the example are placeholders, so set real ones with legal advice.

Why does the register have a Locations sheet?

Erasure only works if it reaches every copy. The Locations sheet lists each place a copy rests, including backups, logs, spreadsheets, email and vendor systems, with an owner and a way to confirm the copy is gone. A copy with no owner is never deleted.

What does Section 8(7) say about erasure?

It requires a Data Fiduciary to erase personal data when consent is withdrawn or as soon as it is reasonable to assume the specified purpose is no longer served, whichever is earlier, unless retention is necessary for compliance with law. It must also cause its Data Processor to erase data made available to it. We found no provision requiring a retention and erasure register.

Is the register free?

Yes. It costs nothing. You enter your name, work email, organisation and role (phone is optional) and tick the consent box. The next page gives you a download link that works for one hour. If it expires, submit the form again.

What happens to my details?

We use them to send you the register and to contact you about it. We send DPDP updates only if you tick the second box. You can withdraw your consent at any time by writing to hi@dpdpactindia.in. The Privacy Policy has the detail.