SCHEDULE-III

See rule 8

Time period for specified purpose to be deemed no longer being served under section 8(8) (Obligations and Legitimate use)

Section 8(8) of the Act

(8) The purpose referred to in clause (a) of sub-section (7) shall be deemed to no longer be served, if the Data Principal does not––
(a) approach the Data Fiduciary for the performance of the specified purpose;  and
(b) exercise any of her rights in relation to such processing, for such time period as may be prescribed, and different time periods may be prescribed for different classes of Data Fiduciaries and for different purposes.
Section (8) (7)(a) of the Act

 A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force,—

(a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and

 

Table

Sl No Class of Data Fiduciaries Purpose Time Period
(1) (2) (3) (4)
1 E Commerce Entity having not less than two crore regisetred users in India Every purpose other than the enablement of the Data Principal to access-
(a) her user account
(b) her money accessible through any service provided or made available by the e-commerce entity; and
(c) any virtual token, object or other similar thing acquired by her, which is usable by her online for accessing or availing of any service provided by the e-commerce entity		 Three years from the date which the data principal last approached the e-commerce entity for performance of the specified purpose or three years from the commencement of the digital personal data protection rules 2023, whichever is later
2 Online gaming intermediary having not less than two crore registered users in India Every purpose other than the enablement of the Data Principal to access-
(a) her user account
(b) her money accessible through any service provided or made available by the online gaming intermediary; and
(c) any virtual token, object or other similar thing  acquired by her, which is usable by her online for accessing or availing of any service provided by the online gaming intermediary		 Three years from the date on which the Data Principal last approached the online gaming  intermediary for performance of the specified purpose, or three years from the commencement of the Digital Personal Data Protection Rules 2023, whichever is later
3 Social media intermediary having not less than two crore registered users in India Every purpose other than the enablement of the Data Principal to access-
(a) her user account
(b)her money accessible through any service provided or made available by the social media intermediary; and
(c) any virtual token, object or otehr similar thing acquired by her which is usable by her online for accessing or availing of any service provided by the social media intermediary		 Three years from the date on which the Data Principal last approached the social media intermediary for performance of the specified purpose or three years from the commencement of the Digital Personal Data Protection rules 2023, whichever is later

Note:
In this schedule,-
(a) "e-commerce" has the same meaning as is assigned to it in the consumer protection act 2019 (35 of 2019)
(b) "e-commerce entity" means any person who owns, operates or manages digital or electronic facility or platform for electronic commerce but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity;
(c) "Intermediary" means a person defined as such in the Information Technology Act, (2000) (21 of 2000)
(d)"Marketplace e-commerce entity" means an e-commerce entity who provides an information technology platform on a digital or electronic network to facilitate transactions between buyers and sellers.
(e) "Online gaming intermediary" means any intermediary who enables the users of its computer resource to access one or more online games;
(f) "social media intermediary" means an intermediary who primarily or solely enables online interaction between two or more users and allows them to create , upload, share, disseminate, modify or access information using her services;
(g) "Seller" means the product seller as defined in clause  (37) of section 2 of the Consumer Protection Act, 2019 (35 of 2019) and shall include any service provider
(h) "user" in relation to-
(i) an e-commerce entity, means any person who accesses or avails any computer resource of an e-commerce entity; and
(ii) an online gaming intermediary or a social media intermediary, means any person who accesses or avails of any computer resource of an intermediary for the purpose of hosting, publishing, sharing, transacting, viewing, displaying, downloading or uploading information.