Inactive customer accounts and the DPDP Rules retention provisions

The final DPDP Rules contain an inactivity provision, but it does not mean every business may keep every dormant customer’s information for three years. The provision identifies particular classes of entities, thresholds and purposes. Applying the number without those conditions can produce the wrong retention schedule.

As of 22 October 2026, the relevant retention rules are scheduled to commence on 13 May 2027 under the commencement notification. Teams preparing for that phase should read Rule 8 and the Third Schedule together, alongside the Act and other applicable retention requirements.

Check whether the entity belongs to a listed class

The Third Schedule covers an e-commerce entity with at least two crore registered users in India, an online gaming intermediary with at least fifty lakh registered users in India and a social media intermediary with at least two crore registered users in India.

Those thresholds are not a universal definition of a large business and do not determine every other DPDP obligation. They serve the particular inactivity provision. A small retailer with a few thousand customer accounts does not enter this rule merely because it sells online.

Conversely, an entity within the listed class should not assume that all its processing is covered identically. The schedule specifies purposes and excludes certain account-access and virtual-token-access processing from the listed purpose description. The exact activity matters.

Understand the trigger before configuring a timer

For the relevant processing, the prescribed period is three years from the date the Data Principal last approached the fiduciary for performance of the specified purpose or exercise of rights, or from commencement of the Rules, whichever is later.

That is more specific than “three years since the last purchase”. A qualifying interaction concerning the purpose or exercise of rights may matter. The business should define and record relevant events based on the legal text rather than choose the easiest existing database timestamp.

Do not simply run a deletion job on the commencement date against every account with an old purchase. The later-of formulation affects the calculation. The team should retain the reasoning behind its configuration and obtain appropriate advice where the facts create uncertainty.

Plan the related warning process

Rule 8(2) requires the fiduciary to inform the individual at least forty-eight hours before completing the prescribed period that the information will be erased, unless the person logs into the account, otherwise initiates contact for performance of the specified purpose or exercises their rights.

The forty-eight-hour warning belongs to this particular inactivity process. It is not a general waiting period for every customer erasure request, nor a universal requirement that every small business send a warning before every scheduled deletion.

A qualifying hypothetical platform should therefore test its audience selection, communication delivery and recognition of relevant activity. A warning that reaches the wrong account or a system that ignores a valid rights interaction can undermine the intended process.

Keep the rest of the retention framework in view

Section 8(7) and (8) of the Act connect erasure with withdrawal, the end of the specified purpose and prescribed inactivity, subject to lawful retention. The inactivity rule should be fitted into that structure rather than treated as a stand-alone permission to retain everything until the timer ends.

Rule 8(3) separately requires personal data, associated traffic data and processing logs to be retained for at least one year from processing for the Seventh Schedule purposes, followed by erasure unless further retention is required by law or a relevant notification. This is a different provision with a different purpose and wording.

Applicable accounting, dispute or other legal requirements may also affect particular categories. Record those categories separately and restrict use appropriately. Retaining an invoice does not necessarily mean maintaining an active marketing profile.

Test a concrete example

Imagine a qualifying e-commerce entity assessing an old account. It should first establish the relevant processing purpose and whether the scheduled category covers it. Next, it should calculate the period using the correct interaction and commencement facts. Then it should operate the warning process and check whether a relevant response changes the result.

Finally, it should apply lawful retention decisions and address processor copies. The account’s visible status is only one part of that outcome.

For a smaller business outside the thresholds, the useful lesson is to build a purpose-based retention process without importing an inapplicable three-year rule. A clear scope assessment prevents a precise-looking number from becoming a mistaken rule across the entire customer database.