Guide
Prepare Your Systems for India's Data Protection Law: Deletion, Retention and Logs First
Discussion of India's data protection law tends to start with consent notices. For a system owner, the harder work lies in deletion, retention and logging, and it needs lead time.
5-minute read5 November 2026
In Brief
- The Act requires erasure once a purpose ends or consent is withdrawn, while the Rules require personal data, traffic data and logs to be kept for at least a year. Deletion needs designing as a state, with dates.
- Four actions: trace one record through every copy, model deletion as states, log access at application level, and bring each vendor into the design.
- Thinqmesh locates your sensitive data, ranks the risk by business impact, reviews access and hands you a costed plan within four weeks, in line with India's data protection law.
Most discussion of India's Digital Personal Data Protection Act begins with consent: the notice, the wording, the checkbox. Those matter, and they are comparatively quick to change. If you are responsible for production systems, the duties that touch every system holding customer data are deletion, retention and logs, and they cannot be met by editing a web page.
Deletion, Retention and Logs Need Lead Time
The Act requires erasure when consent is withdrawn or the purpose is no longer served, unless a law requires retention. The Rules require personal data, traffic data and processing logs to be kept for at least a year for specified purposes. In engineering terms, the delete button can no longer simply delete, and a soft-delete flag rarely meets the duty, because warehouse copies, search indexes and exports carry on as before.
We start with the data you hold and the access to it. We locate your sensitive data, rank the risk by business impact and tighten access first, because breach duties assume you can name affected individuals quickly. Most duties apply some months from now, so check the current Gazette position, and begin with one record traced end to end.
Four Actions That Prepare a System for the Rules
Each one can be started on a single customer-facing system, and each shows where the gaps are before a deadline does.
Trace One Record Through Every Copy
Create a test customer and follow the record through replicas, warehouse, search, backups and each vendor.
Then answer five questions on a single page: what happens when the account is deleted, how long access logs are kept, whether they show which staff member opened this record, which vendors hold a copy, and whether you could list the affected individuals if this table were exposed tonight. The gaps in those answers are your plan.
Get started
- Choose one customer-facing system and create a test customer.
- List every place a copy of that record exists.
Model Deletion as States, With Dates
A record is active, held under the retention duty, or erased, and a date governs each change.
The Act requires erasure when consent is withdrawn or the purpose is no longer served, and the Rules require personal data, traffic data and logs to be kept for at least a year for specified purposes. A record on hold should be out of reach of marketing, analytics and ordinary support, or the hold becomes a loophole.
Get started
- Add a state and a date to the record design for one table.
- Check that warehouse copies and search indexes follow the same state.
Log Access to Personal Data at Application Level
Infrastructure logs may show a database was queried without showing whose record an agent opened.
The Rules ask for visibility of access to personal data through logs, monitoring and review, kept for at least a year. Those logs contain personal data themselves, so they need protection and a considered view of what they capture. Breach duties depend on them, since the first question is whose records were reached.
Get started
- Check whether your logs show which staff member opened which record.
- Check how long they are kept and what a year of retention would cost.
Bring Every Vendor Into the Design
A contract does not move the responsibility.
Your helpdesk, email platform, analytics tool and cloud provider each hold a copy of customer data. The retention and erasure design covers them all, and your contracts say who keeps what. Check the current Gazette position for the dates that apply to you.
Get started
- List the vendors that hold customer data.
- Read what each contract says about retention and deletion.
How Thinqmesh Solves This
We begin by ranking which data, systems and processes would cause most harm if lost, leaked or stopped, and that ranking directs each later stage. Four weeks produce a risk assessment and a costed plan.
- Week 1
What Matters Most
We establish which data, systems and processes matter most to the business, and locate the sensitive data first, because control starts with knowing where it sits.
- Week 2
Access and Exposure
We review who can reach what, and where the organisation is exposed, against that ranking.
- Week 3
Risk in Business Terms
Findings are ranked by business impact, so leadership can see what each risk could cost and decide accordingly.
- Week 4
A Costed Plan
You receive the risk assessment and a costed plan to close the gaps, in the order that matters most.
You finish with your sensitive data located, a ranked risk assessment and a costed plan with your deletion, retention and logging gaps in order. Answers for customer security questionnaires draw on the same work.
