At a glanceAs part of the reasonable security safeguards under India’s DPDP Rules, a business must keep logs of how personal data is processed and accessed for at least one year (unless another law requires longer), so unauthorised access can be detected and investigated. Important distinction: this is about retaining the audit logs, not about holding the underlying personal data longer — you still delete personal data when its purpose ends. Don’t confuse the 1-year log rule with the separate 3-year data erasure that applies only to certain large platforms.
Educational resource only. This explains the log-retention security-safeguard requirement under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
For a tech lead, “retention” under DPDP splits into two very different obligations that are easy to mix up: how long you keep the personal data (as short as the purpose needs), and how long you keep the logs about that data (at least a year). Getting them backwards leads either to over-holding data you should delete, or under-keeping logs you’re required to retain.
What the 1-year rule actually covers
It’s a security-safeguard requirement to retain processing and access logs for a minimum of one year. Under the DPDP framework, reasonable security safeguards (part of the Section 8 obligations) include keeping logs of how personal data is processed and accessed — who touched what, and when — for at least one year, unless a longer period is required by another law. The purpose is defensive: if there’s unauthorised access, those logs are how you detect it, scope it, and investigate. A system with no audit trail can’t show what happened in a breach.
Logs vs the data itself — don’t conflate them
Keep the logs for a year; keep the personal data only as long as its purpose needs. This is the distinction that trips teams up:
- Personal data — governed by purpose limitation and minimisation. You delete it when consent is withdrawn or the purpose is served (the erasure duty). Holding it “for a year to satisfy the log rule” would be wrong — that’s over-retention.
- Logs / audit trail — the record of access and processing events. These you retain for at least a year, as a security safeguard.
So a customer’s data might be deleted after their purpose ends, while the log showing that it was processed and then deleted is kept for the year. Design your systems so the two are separable.
Not the same as the 3-year erasure rule
The 1-year log rule is general; the 3-year data-erasure rule is class-scoped — keep them apart. A separate provision requires certain large platforms — e-commerce and social media with very large user bases, and large online-gaming services — to erase user data after three years of inactivity, with a 48-hour advance notice. That 3-year rule applies only to those notified classes, and it’s about deleting personal data, not retaining logs. If you’re not one of those platforms, the 3-year rule isn’t yours — but the 1-year log-retention safeguard still is.
How to configure it
Build logging in as a security control, retained separately from the data it describes. Practically, for a tech lead:
- Log the right events — access to and processing of personal data (who, what, when), not the sensitive data values themselves.
- Retain logs ≥ 1 year — set retention on your logging/audit store to a minimum of one year (longer only if another law requires).
- Separate log lifecycle from data lifecycle — deleting a user’s personal data shouldn’t wipe the audit trail that records the processing.
- Protect the logs — access-control and tamper-resistance; logs are themselves sensitive and are your breach-investigation evidence.
- Don’t over-log personal data — avoid dumping raw personal data into logs, which would just create more to secure and retain.
FAQ
What does the DPDP 1-year rule require?
Keeping logs of how personal data is processed and accessed for at least one year (unless a longer period applies), as part of reasonable security safeguards, so unauthorised access can be detected and investigated.
Do I have to keep customers’ personal data for a year?
No — that’s the opposite of the duty. You delete personal data when its purpose ends. The one-year retention is for the audit logs, not the underlying data.
Is this the same as the 3-year deletion rule?
No. The 3-year erasure of inactive-user data applies only to certain large e-commerce, social media, and gaming platforms, and concerns deleting data — not retaining logs.
What should the logs contain?
Access and processing events — who accessed or processed personal data and when — not the sensitive data values themselves. Log the trail, not the payload.