We have not yet seen an Indian implementation of it. Not because it's hard to understand, but because it doesn't look like a compliance task until you try to build it.
Who does this apply to?
Rule 8(1) applies the erasure duty to classes of Data Fiduciary specified in the Third Schedule, processing for the corresponding purposes. Three classes, each with a user-count threshold:
| Class | Threshold | Erase after |
|---|---|---|
| E-commerce entity | Not less than 2 crore registered users in India | 3 years of inactivity |
| Online gaming intermediary | Not less than 50 lakh registered users in India | 3 years of inactivity |
| Social media intermediary | Not less than 2 crore registered users in India | 3 years of inactivity |
Two definitional points that change who is in scope. "User" is broader than "customer". For an e-commerce entity the Schedule defines a user as any person who accesses or avails any computer resource of the entity. Registered users who never bought anything count towards two crore.
Marketplace sellers are excluded. The Schedule defines "e-commerce entity" by reference to the Consumer Protection Act, 2019 and expressly excludes a seller offering goods or services on a marketplace e-commerce entity. A brand selling only through someone else's marketplace is outside item 1. The same brand's own storefront is inside it, if it crosses the threshold.
When does the clock start?
Three years from the later of: the date the Data Principal last approached you for performance of the specified purpose or to exercise their rights, or the commencement of the Rules.
That second limb matters. For a customer who last ordered in 2024, the clock effectively starts at commencement rather than at that order — which pushes the first erasures to 2030 for long-dormant accounts, but means the first notices start firing much earlier for anyone whose last contact falls near the boundary.
What survives the clock?
Two purposes are carved out and continue past three years: enabling the Data Principal to access their user account; and enabling them to access a virtual token issued by or on behalf of you, stored on your platform, usable to obtain money, goods or services.
In practice: wallet balances, store credit, gift card value and loyalty points functioning as value do not evaporate at three years, and neither does the account shell needed to reach them. The carve-out covers what is needed for access — not the full order history and not the marketing profile.
Why this is a build, not a policy
Read Rule 8(2) as a specification and you get six requirements: a per-principal clock — not a batch job over a table, since every individual has their own last-contact date and therefore their own erasure date; a class determination — whether the rule applies to you at all depends on your registered-user count against a threshold that changes as you grow; a scheduled notification, 48 hours out, templated and delivered on a channel the person can actually receive; a reset listener, since a login or contact resets the clock and those events have to feed it; an audit record that the notice was sent, when, and to what address; and a retention check before erasing, because Rule 8(3) imposes a separate minimum one-year retention that the erasure at the end of the clock must respect. → See how erasure and retention interact
At two crore users, a meaningful number of these notices fire every single day. There is no manual version.
Someone has to run these clocks
Consiva runs the Rule 8 clocks per data principal, fires the 48-hour notice, listens for the events that reset the clock, and writes the audit record at each step.
Talk to Us About Rule 8 →A worked example
A D2C brand with 2.4 crore registered users. A customer buys in March 2027 and stops using the account.
| Date | Event |
|---|---|
| March 2027 | Purchase. Rule 8(3) one-year retention of order data, traffic data and logs begins |
| March 2028 | The one-year floor expires. Income-tax and Companies Act periods continue on their own terms |
| March 2030 | Three years of inactivity approaches under Rule 8(1) |
| 48 hours before | Rule 8(2) notice must be sent |
| If she logs in | Clock resets to that date |
| If she does not | Erasure proceeds — except account access, any virtual token, and anything a retention mandate still covers |
The uncomfortable adjacent question
The Rule 8(2) notice is, functionally, a re-engagement email with legal force. Send it and a proportion of dormant users will log in, resetting the clock and keeping their data in your systems.
There is nothing improper about that — the Rule expressly contemplates it, and the person is making an informed choice to stay. But the notice must be a genuine notice, not a marketing campaign dressed as one. Copy engineered to maximise reactivation, burying the erasure information, would be hard to defend as compliance with a provision whose purpose is data minimisation.
Draft it as a notice. If reactivation follows, that is a legitimate side effect, not the objective.
Frequently Asked Questions
Rule 8(2) requires a Data Fiduciary to inform the Data Principal at least forty-eight hours before the erasure period completes that their data will be erased, unless they log into their account, otherwise initiate contact for the specified purpose, or exercise their rights.
Third Schedule classes: e-commerce entities and social media intermediaries with not less than two crore registered users in India, and online gaming intermediaries with not less than fifty lakh — subject to the account-access and virtual-token carve-outs.
No. The Schedule's definition expressly excludes a seller offering goods or services on a marketplace e-commerce entity. A brand running its own storefront is in scope for that storefront if it crosses the threshold.
No. The Schedule carves out access to the user account and to a virtual token stored on the platform that can be used to obtain money, goods or services. The carve-out covers what is needed for access, not the entire profile.
Yes. The period runs from the Data Principal’s last approach for the specified purpose or exercise of rights, so a login or contact resets it — which is precisely what the 48-hour notice invites.
13 May 2027, along with the rest of the substantive obligations and the penalty regime.
Above a Third Schedule Threshold?
Consiva runs the Rule 8 clocks per data principal, fires the 48-hour notice, listens for the events that reset the clock, checks the retention register before erasing, and writes the audit record at each step.