1. Introduction

Data retention legal requirements are the laws, regulations, and judicial principles governing how long an organisation, government authority, healthcare provider, research institution, or technology company may or must preserve information.

Data retention law addresses five central questions:

What information must be retained?

For what legal or operational purpose may it be retained?

How long must or may it be stored?

When must it be deleted, anonymised, or archived?

What legal consequences follow from unlawful deletion or excessive retention?

Data retention is especially important in biotechnology, clinical trials, genomic databases, digital health, financial services, telecommunications, employment records, and criminal investigations.

The governing principle is that data should be retained for as long as a valid legal requirement or legitimate purpose justifies it—not indefinitely merely because storage is possible. However, certain laws expressly require preservation for a minimum period, and organisations may also have to preserve relevant records during litigation or an investigation.

The precise rule depends on the jurisdiction, type of data, industry, and purpose of processing.

2. Principal legal principles

A. Storage limitation

Personal information should not remain identifiable for longer than necessary for the purposes for which it was collected or subsequently lawfully processed.

B. Statutory preservation

Some legislation requires specified records to be retained for a defined minimum period, even if the original business purpose has ended.

C. Accountability and security

Organisations should be able to justify their retention periods, restrict access, monitor storage, and demonstrate compliance.

D. Preservation for legal proceedings

Relevant documents and electronic records may need to be preserved when litigation, regulatory enforcement, or an investigation is reasonably anticipated or formally commenced.

A key distinction is that a maximum retention principle and a mandatory minimum retention period can operate simultaneously. Organisations must reconcile them rather than automatically applying whichever period is longest to every record.

3. Legal framework in India

India's data retention framework is not contained in a single statute. It consists of privacy legislation, information-technology rules, company and tax laws, sector-specific regulations, and judicial decisions.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data. Its principal provisions relevant to retention include:

Section 4: Processing must have a lawful basis under the Act.

Section 8: Data fiduciaries have general obligations concerning lawful processing, security, and erasure.

Section 8(7): Personal data must be erased when consent is withdrawn or it is reasonable to assume the specified purpose is no longer being served, unless retention is necessary for compliance with law.

Section 12: Provides rights relating to correction, completion, updating, and erasure, subject to applicable legal requirements.

Section 17: Provides specified exemptions from the Act.

Official legislation: Read the DPDP Act, 2023.

India Code+1

Important commencement qualification: The Act was enacted in 2023, and the DPDP Rules were notified in November 2025. The commencement notification phases the provisions into operation. The core processing and erasure provisions in sections 3–17 are scheduled to commence 18 months after 13 November 2025—on 13 May 2027. Accordingly, as of 5 November 2026, these provisions should not be treated as already operative merely because the Act and Rules have been published. Existing applicable laws remain important during the transition.

E-Gazette+1

B. DPDP Rules, 2025: retention and erasure

The Rules establish more specific requirements for certain categories of data fiduciaries.

Rule 8 and the relevant schedules address erasure following periods of inactivity for specified large e-commerce, social-media, and online-gaming entities. The Rules also provide for a minimum one-year retention period for specified personal data, associated traffic data, and processing logs, for the purposes set out in the Seventh Schedule, subject to the Rules' commencement provisions and exceptions for retention required by other applicable laws.

IndiaCode+1

This distinction is crucial:

The one-year requirement is not a universal rule that every organisation must retain every kind of data for one year.

It applies to the processing and purposes covered by the relevant provision.

Other laws may require longer retention.

Where the provision is not yet in force, it should not be presented as an already operative obligation.

C. Information Technology Act and Intermediary Rules

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 contain specific preservation obligations.

Under Rule 3(1)(g), intermediaries must preserve specified information and associated records that have been removed or disabled for investigation purposes for 180 days, or longer when required by a court or an authorised government agency.

Rule 3(1)(h) requires retention of registration information for 180 days after cancellation or withdrawal of registration. These requirements concern the information covered by the respective clauses; they do not mean every item of platform data must be retained for 180 days.

MeitY+1

Official source: Read the Intermediary Rules.

D. Companies Act, 2013

Section 128(5) of the Companies Act, 2013 requires companies to preserve their books of account and relevant vouchers for at least eight financial years immediately preceding the current financial year, subject to the statutory wording and any direction requiring a longer period.

Where a company is under investigation, the Central Government may direct that records be preserved for longer. Section 128(6) also provides for penalties for specified contraventions.

128

This is an example of a statutory recordkeeping obligation that may justify retaining financial records even when a business no longer needs them for day-to-day operations.

E. Other laws and sector-specific requirements

Retention periods may also arise under:

Income-tax and GST legislation, including rules concerning books, returns, invoices, and supporting documents.

Banking and financial-sector regulations governing customer due diligence, transactions, and audit records.

Telecommunications and cybersecurity directions applicable to particular entities.

Clinical-trial, medicines, medical-device, and research regulations.

Evidence and procedural laws governing documents relevant to investigations or litigation.

There is no single retention period that applies to all these categories. The applicable statute, subordinate rules, regulator directions, record type, and relevant commencement dates must be checked separately.

4. International legal requirements

A. European Union — GDPR

Article 5(1)(e) of the General Data Protection Regulation (GDPR) establishes the principle of storage limitation. Personal data must generally remain identifiable only for as long as necessary for the purpose of processing.

Article 5(2) requires accountability, while Article 17 establishes a right to erasure in specified circumstances, subject to exceptions. Article 17(3), for example, recognises exceptions involving legal obligations, public-interest tasks, and the establishment, exercise, or defence of legal claims.

The GDPR permits longer storage for qualifying archiving in the public interest, scientific or historical research, or statistical purposes, subject to appropriate safeguards under Article 89.

Official text: General Data Protection Regulation.

B. United States

The United States uses a combination of federal and state laws rather than one universal retention period for all personal information.

Examples include:

HIPAA regulations governing specified healthcare records and related documentation.

Financial-services legislation and regulatory rules for covered institutions.

State privacy statutes governing deletion, data minimisation, and retention disclosures.

Federal and state procedural rules requiring preservation of relevant electronically stored information in litigation.

For example, HIPAA's 45 CFR § 164.530(j) generally requires covered entities and business associates to retain specified compliance documentation for six years from creation or the date it was last in effect, whichever is later. This is not a universal six-year retention requirement for every medical record.

Official source: HIPAA regulations, 45 CFR Part 164.

C. International comparison

5. Leading judicial decisions and case laws

The following cases are particularly important for understanding the legality of retaining personal information, digital records, and evidence.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and legal issue: The Supreme Court considered whether privacy is a constitutionally protected fundamental right under the Indian Constitution.

Judgment: The Court unanimously recognised privacy as a fundamental right protected under Article 21 and other constitutional freedoms. Informational privacy and control over personal information form important dimensions of that protection.

Relevance to data retention: Retaining personal information can interfere with privacy even when the information was originally collected lawfully. The constitutional framework requires state action affecting privacy to satisfy legality, a legitimate objective, and proportionality, together with the applicable constitutional safeguards.

Legal principle: Government data-retention measures should not be indiscriminate or disproportionate to their legitimate purpose. The precise legality of a particular retention scheme depends on its statutory basis, scope, duration, safeguards, and impact.

Case 2. Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar judgment, 2018)

Supreme Court of India · (2019) 1 SCC 1

Facts: The Court examined the constitutional validity of the Aadhaar framework, including the collection, use, disclosure, and storage of identity-linked information.

Judgment: The Court upheld the Aadhaar framework in substantial part but invalidated or limited certain aspects of its operation, including aspects of private-sector use and mandatory linking.

Relevance: The case illustrates that the retention and use of identity-linked data must be assessed against statutory authority, privacy protections, and proportionality. It also demonstrates that collecting data for one legitimate purpose does not automatically justify every subsequent use or disclosure.

Legal principle: Data retention must be assessed within the specific statutory framework and constitutional restrictions applicable to the information concerned.

Case 3. Google Spain SL and Google Inc. v. AEPD and Mario Costeja González

CJEU · Case C-131/12 · 13 May 2014

Facts: Mario Costeja González sought relief concerning search-engine results linking his name to an old newspaper notice relating to debt-recovery proceedings.

Judgment: The Court recognised that, in appropriate circumstances, a person may request the removal of links to information that has become inadequate, irrelevant, or no longer relevant, having regard to the time elapsed. The case concerned de-referencing by search engines, not a general right to erase every underlying record.

Relevance to retention: Information that was initially lawful and accurate may become excessive or no longer necessary in a particular context.

Legal principle: The passage of time and the continuing relevance of information matter when assessing ongoing processing.

Homepage | Data Protection Commission

Case 4. Digi Távközlési és Szolgáltató Kft. v. Nemzeti Adatvédelmi és Információszabadság Hatóság

CJEU · Case C-77/21 · 20 October 2022

Facts: A telecommunications provider copied customer data into a separate database used for testing and correcting errors. The question included whether those data could be kept for longer than necessary for that secondary purpose.

Judgment: The Court held that GDPR purpose limitation does not necessarily prohibit compatible secondary processing, but storage limitation prohibits retaining the data in the testing database for longer than necessary to conduct the tests and correct the errors.

Relevance: Organisations cannot justify indefinite retention merely by labelling a database as a testing, analytics, backup, or troubleshooting environment.

Legal principle: Every separate processing purpose should have a justified retention period.

EUR-Lex+1

Case 5. Rijkeboer v. College van burgemeester en wethouders van Rotterdam

CJEU · Case C-553/07 · 7 May 2009

Facts: The dispute concerned access to information about disclosures of personal data by a municipal authority and limits on the period for which disclosure information was available.

Judgment: The Court considered the practical effectiveness of data-subject access rights and the relationship between those rights and the retention of information about disclosures.

Relevance: Organisations should consider not only whether the original personal data need to be retained, but also whether audit and disclosure records must be kept so individuals can exercise their rights effectively.

Legal principle: Retention schedules must be assessed alongside transparency, access rights, and the applicable statutory framework.

Case 6. Digital Rights Ireland Ltd v. Minister for Communications, Marine and Natural Resources

CJEU · Joined Cases C-293/12 and C-594/12 · 8 April 2014

Facts: The Court examined EU legislation requiring the retention of telecommunications traffic and location data for law-enforcement purposes.

Judgment: The Court invalidated the Data Retention Directive because it entailed a wide-ranging and particularly serious interference with fundamental rights without adequate safeguards.

Relevance: Mandatory retention for public security is not automatically lawful simply because it has a legitimate objective.

Legal principle: The scope of data collected, retention duration, access controls, and safeguards against abuse must be proportionate to the objective pursued.

Case 7. La Quadrature du Net and Others

CJEU · Joined Cases C-511/18, C-512/18 and C-520/18 · 6 October 2020

Facts: The cases concerned national requirements for retaining communications data and granting authorities access to those data for national-security and law-enforcement purposes.

Judgment: The Court distinguished between different categories of retention and objectives. It recognised that certain targeted or limited forms of retention may be permissible under strict conditions, while general and indiscriminate retention is subject to stringent restrictions.

Relevance: This is particularly important for telecom operators, digital platforms, cybersecurity systems, and government surveillance databases.

Legal principle: The legality of retention depends on the nature of the data, the threat addressed, the duration and breadth of the obligation, and effective safeguards.

Case 8. SCHUFA Holding AG v. Verbraucherzentrale

CJEU · Joined Cases C-26/22 and C-64/22 · 7 December 2023

Facts: The dispute concerned the retention of information relating to the discharge of residual debts by a credit-information agency.

Judgment: The Court examined the relationship between storage limitation, creditworthiness assessment, and the retention of information beyond the period for which public insolvency registers retained it.

Relevance: The longer personal data are retained, the greater the potential interference with an individual's private life. A commercial interest in retaining information does not automatically justify an extended retention period.

Legal principle: Retention practices require a proportionate justification, especially when old data may affect credit access or other significant decisions.

EUR-Lex

6. Legal consequences of unlawful data retention

An organisation that retains information unlawfully may face several kinds of legal exposure.

The availability and severity of each consequence depend on the applicable law, the organisation's role, the nature of the breach, and the evidence of harm or non-compliance. Excessive retention does not automatically establish every form of civil or criminal liability.

7. Practical compliance framework for organisations

A defensible retention programme should follow a documented process.

Data retention compliance checklist

Use this checklist to assess readiness.

0 of 8

Inventory personal data, research records, financial documents, logs, backups, and archived information.

Identify the legal basis and operational purpose for retaining each category.

Record statutory minimum periods, applicable maximum limits, and relevant commencement dates.

Establish a retention schedule with defined periods or objectively verifiable review criteria.

Implement automated deletion, anonymisation, or archival processes where appropriate.

Apply legal holds to records relevant to anticipated or ongoing proceedings.

Restrict access and protect retained information against loss, alteration, and unauthorised disclosure.

Document exceptions, deletion decisions, periodic reviews, and audit results.

8. Application to biotechnology and clinical research

Data retention has additional importance in biotechnology because scientific integrity, participant protection, product safety, and regulatory traceability may require preserving records after a study or commercial activity ends.

Examples include:

Clinical-trial data: Protocols, informed-consent documents, case-report forms, safety reports, and essential trial records may have specific regulatory retention periods.

Genomic databases: Identifiable genetic information may require continuing protection even after a research project ends.

Biological samples: Rules governing the storage and destruction of tissue, blood, and other specimens may differ from those governing associated digital data.

Laboratory records: Electronic audit trails, instrument calibration records, and quality-control documentation may need to remain available for inspection.

AI training datasets: Organisations should justify the continuing use and retention of identifiable training data, including data copied into testing environments and backups.

A clinical research organisation should therefore maintain separate retention schedules for participant-identifiable data, pseudonymised research datasets, essential trial documents, biological samples, and regulatory audit trails. The applicable trial rules and jurisdiction determine the exact periods.

9. How to resolve conflicts between retention and erasure

Suppose a customer requests deletion of their personal data, but the organisation must preserve an invoice for a statutory accounting period.

The legally appropriate response is not necessarily to delete everything or to keep the entire customer profile indefinitely. Instead, the organisation should:

Identify which records must be retained by law.

Delete or anonymise information that is no longer necessary and is not subject to another preservation obligation.

Restrict legally required records to the purposes for which retention is justified.

Establish the date or event that triggers eventual deletion.

Document the reason for refusing or limiting an erasure request, where the applicable law requires it.

The same approach applies when litigation requires preserving records that would otherwise be due for deletion.

10. Conclusion

Data retention law balances three competing interests: privacy, lawful recordkeeping, and the preservation of evidence.

The Indian constitutional privacy jurisprudence, the DPDP framework, sector-specific legislation, and international decisions on storage limitation collectively demonstrate that neither indiscriminate retention nor indiscriminate deletion is an adequate compliance strategy.

A legally sound system identifies the correct retention period for each category of data, records the legal basis for keeping it, protects it while retained, and securely deletes or anonymises it when the applicable purpose and preservation obligations have ended.

For a more precise legal analysis, the next useful step is to examine data retention requirements under Indian law specifically for healthcare, biotechnology, genomic data, clinical trials, or corporate records, because the applicable periods and case law differ substantially across those fields.