E-com, gaming, social media platforms mandated to erase user data after 3 years

The government has introduced new provisions under the Digital Personal Data Protection Act that require data fiduciaries, including e-commerce platforms, online gaming services, and social media networks, to erase users' personal data after three years if it is no longer necessary for its intended purpose. This move aims to strengthen data privacy and ensure that companies do not retain unnecessary personal information.

These requirements are outlined in Section 8 of the draft rules, which mandate that data fiduciaries delete personal data once it is no longer needed. The Third Schedule of the draft details specific timelines for data erasure, depending on the type of data fiduciary—whether an e-commerce platform, online gaming intermediary, or social media service.

Platforms are required to notify users at least 48 hours before data erasure, providing an opportunity for users to log in or make contact if they wish to retain their data. Personal information linked to a user’s account, such as profiles, email addresses, or phone numbers, will be subject to this rule.

The draft, which was made available for public consultation on January 3, 2025, will remain open for feedback until February 18, 2025. It classifies e-commerce platforms as entities with at least 2 crore registered users in India, while online gaming intermediaries must have 50 lakh or more users. Social media platforms are defined as having a user base of 2 crore or more.

Further, the draft specifies that these data fiduciaries must allow users to access their accounts and provide access to any virtual tokens or assets that can be exchanged for money, goods, or services. The rules also define each category of fiduciary, specifying that an e-commerce entity refers to a digital platform for online commerce as per the Consumer Protection Act, 2019, while online gaming intermediaries are those facilitating online game access.

For social media intermediaries, the rules define them as entities enabling online interactions, where users can create, upload, and share content, primarily to facilitate digital communication.