DPDP Data Retention Policy Template

DATA RETENTION AND DELETION POLICY

[Effective Date: ___________]

1. PURPOSE

This Data Retention and Deletion Policy establishes guidelines for how long [Company Name] retains personal data and the procedures for secure deletion, in compliance with Section 8(6) of the Digital Personal Data Protection Act, 2023.

2. SCOPE

This policy applies to all personal data collected, processed, and stored by [Company Name], including but not limited to:

• Customer information
• Employee records
• Vendor and partner data
• Transaction records
• Marketing and communications data

3. RETENTION PERIODS BY DATA CATEGORY

DPDP Reference: Section 8(6) - Retention of personal data

4. DELETION PROCEDURES

4.1 Automated Deletion

• Automated scripts run monthly to identify data that has exceeded retention period
• System-generated reports sent to Data Protection Officer for review
• Deletion executed after 30-day review period unless legal hold applies

4.2 Manual Deletion Requests

Data principals can request deletion of their data by:
• Email: [privacy@yourcompany.com]
• Self-service portal: [URL]
• Written request to Grievance Officer

Deletion requests are processed within 30 days unless legal/contractual obligations require retention.

4.3 Secure Deletion Methods

• Digital data: Permanent deletion with 3-pass overwrite (DoD 5220.22-M standard)
• Physical documents: Cross-cut shredding with certificate of destruction
• Backup systems: Deletion from all backup copies within 90 days
• Third-party systems: Deletion confirmation obtained in writing

5. LEGAL HOLD EXCEPTIONS

Data will NOT be deleted if subject to:
• Active litigation or legal proceedings
• Government/regulatory investigation
• Pending audit or dispute
• Court order or legal obligation

Legal holds are documented and reviewed quarterly by Legal & Compliance teams.

6. ARCHIVAL PROCEDURES

Data that must be retained for legal/regulatory compliance but is no longer actively used is:
• Moved to secure archival storage (offline/cold storage)
• Access restricted to authorized personnel only
• Encrypted with AES-256
• Indexed for retrieval if required for legal purposes

7. ROLES AND RESPONSIBILITIES

Data Protection Officer:
• Oversees policy implementation
• Reviews monthly deletion reports
• Approves exceptions to retention periods

IT Department:
• Implements automated deletion scripts
• Maintains deletion audit logs
• Executes secure deletion procedures

Department Heads:
• Ensure team compliance with retention schedules
• Identify data for legal hold
• Report retention issues to DPO

8. AUDIT AND MONITORING

• Quarterly retention compliance audits conducted by Internal Audit
• Deletion logs maintained for 7 years
• Annual policy review and update
• Non-compliance incidents reported to Data Protection Board

9. EXCEPTIONS AND APPROVALS

Any deviation from standard retention periods requires:
• Written request with business justification
• Legal review and approval
• DPO sign-off
• Documentation in exception register

10. POLICY REVIEW AND UPDATES

This policy is reviewed annually or when:
• Legal/regulatory requirements change
• Business operations materially change
• Data Protection Board issues new guidelines
• Significant compliance issues identified

11. CONTACT INFORMATION

For questions about this policy:
Data Protection Officer: [Name]
Email: [dpo@yourcompany.com]
Phone: [Contact Number]

Approval:
Policy Owner: [Data Protection Officer Name]
Approved By: [CEO/Board]
Effective Date: [Date]
Next Review Date: [Date + 1 year]
Version: 1.0