Under the DPDP Rules 2025, personal data must be erased once the purpose it was collected for is no longer being served — for example when a student leaves and statutory retention has lapsed, or when consent is withdrawn. Schools can’t keep ex-students’ data forever ‘just in case’. This article explains the erasure principle, how to set sensible retention periods for different record types, and how to build a defensible retention schedule instead of hoarding data on old drives.
FAQ
Q: How long can a school keep student data?
A: Only as long as the purpose is served (plus any statutory minimum); after that it should be erased.
Q: What triggers erasure under DPDP?
A: Purpose fulfilled, consent withdrawn, or the retention period lapsing.
Call Now
WhatsApp