Rule 8: Time period for specified purpose to be deemed as no longer being served

A Data Fiduciary (an entity that decides how and why data is processed) must erase personal data if the Data Principal (the individual the data is about) stops interacting with them for a set time. This rule applies to specific classes of Data Fiduciaries and purposes listed in the Third Schedule. If the Data Principal does not contact the Data Fiduciary or exercise their rights for the time period specified in that schedule, the data must be erased, unless another law requires keeping it.

Before erasing this data, the Data Fiduciary must give the Data Principal advance notice. At least forty-eight hours before the time limit expires, the Data Fiduciary must inform the individual that their data will be erased. The erasure is stopped if the individual logs into their account, contacts the Data Fiduciary for the original purpose, or exercises their rights regarding the data before the period ends.

Despite the rules above, there is a mandatory minimum retention period for certain records. A Data Fiduciary must keep personal data, associated traffic data, and processing logs for at least one year from the date of processing for purposes listed in the Seventh Schedule. This one-year rule applies whether the processing is done by the Data Fiduciary or by a Data Processor (an entity processing data on its behalf). After one year, the data and logs must be erased unless another law or government notification requires keeping them longer.

Key points

• Data Fiduciaries listed in the Third Schedule must erase personal data if the Data Principal does not interact with them for the time period specified in that schedule. [(1)]
• The Data Fiduciary must notify the Data Principal at least forty-eight hours before this time period ends and the data is erased. [(2)]
• The erasure is paused if the Data Principal logs in, initiates contact, or exercises their rights before the deadline. [(2)]
• Data Fiduciaries and their Data Processors must retain personal data, traffic data, and processing logs for a minimum of one year for purposes in the Seventh Schedule. [(3)]
• After the one-year minimum, the data and logs must be erased unless another law requires longer retention. [(3)]

Common misreadings

• A Data Fiduciary can erase data the moment the time period in the Third Schedule ends without telling the Data Principal. (Correction: The Data Fiduciary must inform the Data Principal at least forty-eight hours before the time period is completed.)
• If a Data Principal deletes their account, the Data Fiduciary must immediately erase all records of their past transactions. (Correction: The Data Fiduciary must still retain personal data and processing logs for a minimum of one year from the date of processing for purposes in the Seventh Schedule.)