Inactive is nota retention strategy.

For large platforms, the Rules put a clock on silence.

In one line: The Rules require certain e-commerce entities above a registered-user threshold in India to erase personal data of users who have not engaged for three years, after informing them at least 48 hours in advance, unless retention is required by law.

The estate · E-commerce & D2CHover to inspect

The customer left. The data should follow.

The scene

Forty percent of accounts had not logged in for three years. Marketing called them ‘win-back potential’. Under the Rules, for a platform of that size, they were a deletion queue with a notice period.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Dormant users might come back. For covered platforms the Rules require erasure after three years of inactivity, with prior notice. Notify, invite back, then erase on schedule.
Order history must be kept forever. Keep what tax and consumer law require; erase the rest. Separate invoices from profiles.

Designing the notice

The Rules require notice before erasure. Treat it as the last honest message: here is what we hold, here is when it goes, here is how to keep your account.

Monday morning

  1. 01Count accounts inactive for over three years.
  2. 02Separate records required by law.
  3. 03Draft the pre-erasure notice.

Questions, answered plainly

What is the three-year erasure rule for e-commerce under the DPDP Rules?

The Rules require certain e-commerce entities above a registered-user threshold in India to erase personal data of users who have not engaged for three years, after informing them at least 48 hours in advance, unless retention is required by law.

Can e-commerce companies keep invoices after erasing accounts?

Yes, where tax or other law requires retention. Only data required by law should be retained, for the period required.

Sector · E-commerce & D2CYour funnel runs on consent. The Act just redefined consent.Read → E-commerce & D2C · Deep diveForty pixels on checkout. Forty processors without paper.Read → E-commerce & D2C · Deep diveA trick is not an agreement.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner