Third Schedule: Time periods after which specified Data Fiduciaries must erase personal data

Schedule III of the DPDP Rules, 2025 sets specific time limits for certain large Data Fiduciaries (entities determining the purpose and means of processing personal data) to retain personal data. It applies to three classes of Data Fiduciaries based on their registered users in India: e-commerce entities with at least two crore users, online gaming intermediaries with at least fifty lakh users, and social media intermediaries with at least two crore users. For these specific entities, the standard time period to retain personal data is three years. This three-year clock starts from the date the Data Principal (the individual to whom the data relates) last approached the Data Fiduciary for the specified purpose or to exercise their rights, or from the commencement of the Digital Personal Data Protection Rules, 2025, whichever is latest. There are two exceptions to this three-year time limit. The limit does not apply to data needed to enable the Data Principal to access their user account. It also does not apply to data needed to access virtual tokens issued by the Data Fiduciary that are stored on their platform and can be used to get money, goods, or services. The Schedule also defines these entities. An e-commerce entity operates a digital platform for e-commerce but does not include individual sellers on a marketplace. An online gaming intermediary enables access to online games, and a social media intermediary is defined under the Information Technology Rules, 2021. A user is anyone who accesses or avails the computer resources of these entities.

Key points

• E-commerce entities and social media intermediaries with at least two crore registered users in India are subject to a three-year data retention limit [Items 1 & 3].
• Online gaming intermediaries with at least fifty lakh registered users in India are subject to the same three-year limit [Item 2].
• The three-year period begins from the Data Principal's last approach or the commencement of the DPDP Rules, 2025, whichever is latest [Items 1, 2, & 3].
• The time limit applies to all purposes except enabling access to a user account or accessing virtual tokens used for money, goods, or services [Items 1, 2, & 3].
• Individual sellers offering goods on a marketplace are excluded from the definition of an e-commerce entity [Note (a)].

Common misreadings

• People might think the three-year limit applies to all data held by these entities, but it explicitly excludes data needed to access user accounts or virtual tokens.
• People might assume individual sellers on an e-commerce platform are bound by the two-crore user threshold, but the text specifically excludes sellers on a marketplace e-commerce entity.