How long can an Indian company keep customer data in its CRM under DPDPA?

Every sales and marketing team we meet has the same CRM: ten years of leads, half of them never contacted again, exported to three spreadsheets and one WhatsApp group. Under the Digital Personal Data Protection Act, 2023 that habit becomes a compliance question with a specific legal answer. This post explains what the Act and the DPDP Rules, 2025 actually say about keeping customer and prospect data, which Indian laws let you keep records longer, and how to turn that into a retention schedule a CRM can enforce.

What does Section 8(7) of the DPDP Act require?

Section 8(7) is the core rule. A Data Fiduciary must erase personal data when the Data Principal withdraws consent, or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier, unless retention is necessary to comply with another law in force. The same sub-section requires you to make sure any Data Processor working for you erases the data too, so an outsourced calling agency or a marketing-automation vendor holding your lead list is your responsibility.

Three things follow for a CRM. First, the clock is tied to purpose, not to a calendar: a lead collected to quote on a project has served its purpose once the deal is won, lost or abandoned. Second, withdrawal of consent must be as easy as giving it (Section 6(4)), and once a person withdraws, the record cannot sit in a "do not contact" list indefinitely; it must be erased unless a law requires otherwise. Third, "another law" is a real exception, not a loophole: you need to be able to name the law and the record it covers.

Does the three-year inactivity rule apply to my CRM?

Almost certainly not. Rule 8 of the DPDP Rules, 2025 adds a time-based erasure duty, but only for the classes of Data Fiduciary listed in the Third Schedule. Those fiduciaries must erase a user's personal data once three years have passed without the person approaching them or exercising a right, counted from the later of that last contact or the commencement of the Rules, and must warn the person at least 48 hours before erasure so they can log in and keep the account.

Class of Data Fiduciary	Threshold (registered users in India)	Erasure after
E-commerce entity	2 crore or more	3 years of inactivity
Online gaming intermediary	50 lakh or more	3 years of inactivity
Social media intermediary	2 crore or more	3 years of inactivity
Everyone else (B2B SaaS, manufacturers, agencies, NBFCs, clinics)	No threshold	Section 8(7) purpose test only

So a typical Indian B2B company does not get a three-year safe harbour. It gets the stricter, purpose-based test, which in practice often points to shorter retention for cold leads than three years. The Rules do add a floor in the other direction: personal data, traffic data and processing logs must be kept for at least one year from the date of processing for security-monitoring purposes (Rule 6), unless another law requires longer. Thirty- or ninety-day log rotation on your CRM or marketing stack falls below that.

Which Indian laws let you keep customer records longer?

The "another law" exception is where most legitimate long retention lives. The periods below are the ones most commonly cited for commercial records; confirm the exact provision for your sector with counsel.

Law	What it covers	Commonly cited period
Companies Act, 2013, s.128	Books of account and related vouchers, including sales invoices	8 financial years
Income-tax Act, 1961, s.44AA and Rule 6F	Books and documents supporting returns	6 years from the end of the relevant assessment year
CGST Act, 2017, s.36	Accounts and records for each tax period	72 months from the due date of the annual return
PMLA, 2002, s.12 and PML Rules	KYC and transaction records of reporting entities (banks, NBFCs, some fintechs)	5 years after the business relationship or transaction ends
Sectoral regulators (RBI, SEBI, IRDAI)	Customer records of regulated entities	Varies by direction; often 5 to 10 years

Notice what these laws cover: invoices, contracts, KYC files, transaction records. None of them requires you to keep a prospect's mobile number, their LinkedIn profile, the notes from a discovery call or their email-open history. That is the practical split for a CRM: customer and transaction records inherit the longest statutory period that applies; prospect and engagement data are governed by Section 8(7) alone.

What does "purpose no longer served" mean for a sales pipeline?

The Act does not define it, so the honest approach is to define it yourself, write it down, and apply it consistently. A workable schedule for an Indian B2B company looks like this (these are design choices, not statutory periods):

1. Inbound enquiry, no response after follow-up: purpose ends when the sales process is closed; erase within a short, fixed window such as 90 to 180 days after the last two-way contact.
2. Open opportunity: retain while the opportunity is active; close-lost triggers the same window as above.
3. Customer under contract: retain contact and account data for the life of the contract plus any statutory period for invoices and contracts.
4. Former customer: keep transaction records for the statutory period; erase marketing-engagement data and personal notes at contract end unless fresh consent is obtained.
5. Consent withdrawn or erasure request received: erase from the CRM, marketing tools and processors, keeping only the minimum needed to honour the withdrawal and to prove you did.
6. Purchased or scraped lists: there is no purpose the person agreed to, so there is no retention period to compute. See our note on purchased lead lists under DPDPA.

Erasure requests themselves are a right under Section 12, and your grievance process must respond within the period you publish, capped at 90 days under the Rules. Our guide to handling access, correction and erasure requests covers the workflow.

How do you build retention into the CRM itself?

A policy document does not erase anything. The controls that make Section 8(7) real inside a CRM are:

1. Purpose and lawful-basis fields on every contact. Each record carries why it was collected and on what basis (consent, or a legitimate use under Section 7), so the retention rule can be computed per record.
2. Last-meaningful-contact timestamp. Not "last modified", which a bulk import resets, but the last two-way interaction with the person.
3. Automated retention workflows. Stage-based rules that flag, then erase, records once their purpose window closes, with a legal-hold override for data covered by another law.
4. Processor sync. Erasure must propagate to marketing automation, dialers, WhatsApp Business tools and agencies, with confirmation back, because Section 8(7) makes you answerable for them.
5. Consent withdrawal as a first-class event. One click for the Data Principal, one workflow for the team, as Section 6(4) requires.
6. Evidence. Logs of what was erased, when and on what rule, kept for the one-year Rule 6 period and for any dispute, without re-storing the personal data you just removed.

This is the design behind QQCRM, Qodequay's AI CRM accelerator, which carries purpose, consent and retention fields natively and connects to DAPro (Data Adhikaar), our DPDPA compliance platform, for notices in 22 languages, a tamper-evident Evidence Vault and 25+ connectors to the rest of your stack. If you already have a CRM, start with our eight-check DPDPA CRM audit.

What should a CFO or sales head do before May 2027?

The retention and erasure duties, like most of the Act, take effect on 13 May 2027 under the Rules' 18-month schedule, with the Consent Manager framework starting on 13 November 2026. The cost of waiting is not only the Schedule penalties, up to ₹250 crore for failing to maintain reasonable security safeguards, but the operational mess of trying to classify a decade of leads in the final quarter. A retention schedule agreed now, applied to new records from day one, and run as a one-time clean-up on the backlog, is a far smaller project than it looks.

Qodequay is ISO 27001:2022 certified and works with Indian sales, finance and compliance teams to make CRMs DPDPA-ready without slowing the pipeline. Book a 30-minute CRM retention review and we will map your pipeline stages to a retention schedule you can defend.

This article is for general information and is not legal advice. Confirm obligations against the official texts of the DPDP Act, the DPDP Rules and the sectoral laws that apply to you, and consult qualified counsel for your situation.