Data Retention Policy Under the DPDP Act: What Free Mobile's €27m Fine Teaches Indian SMEs

Most Indian SMEs we speak to can tell us where their customer data comes from. Far fewer can tell us when it leaves. Old leads sit in the CRM for years, former employees' PAN copies live in a shared drive, and every customer who ever placed one order is still in the marketing list. Under the Digital Personal Data Protection Act, 2023, that habit becomes a liability. A clear data retention policy under the DPDP Act is one of the cheapest compliance wins available to you, and one of the most overlooked.

A recent French decision shows why "we'll clean it up later" is an expensive plan.

What the Free Mobile fine tells us

In January 2026, France's data protection authority, the CNIL, fined telecom operator Free Mobile €27 million and its sister company Free €15 million. The trigger was an October 2024 cyberattack that exposed data linked to 24 million subscriber contracts, including bank account details (IBANs).

Security failures drove most of the penalty. But the CNIL also found a separate breach against Free Mobile alone: it had kept data on former subscribers for far longer than needed. In the CNIL's words, the company had not put in place measures "to sort the data of former subscribers in order to retain only those necessary for accounting purposes and then delete them." It held "millions of pieces of data" without justification. The regulator ordered Free Mobile to finish sorting and purging that data within six months.

Data you no longer need is data that can still be stolen. When a breach happens, every stale record in the leaked set makes the harm larger and the regulator less sympathetic. The CNIL's own sanctions list for 2025 and early 2026 shows retention failures cited against a furniture e-retailer (€600,000), a dating site (€20,000), an event-ticketing company (€15,000) and a small tourist-accommodation business (€3,000). Size does not exempt you.

What the DPDP Act says about erasing personal data

The core rule sits in Section 8(7) of the DPDP Act. A Data Fiduciary must erase personal data, and make its Data Processors erase it too, once the Data Principal withdraws consent or as soon as it is reasonable to assume the specified purpose is no longer being served, whichever is earlier. The only carve-out is where another law requires you to keep the data.

That last point matters for Indian SMEs. Tax, GST, company law, labour law and sector rules (RBI, SEBI, IRDAI) often require you to hold certain records for set periods. The DPDP Act does not override those. What it does is stop you from keeping everything else indefinitely "just in case".

Failing to meet Section 8 obligations that are not covered by a specific penalty line can attract a penalty of up to ₹50 crore under the Schedule to the Act. Security-safeguard failures carry up to ₹250 crore, and if a breach exposes data you should already have deleted, you may face both questions at once.

Rule 8: fixed deadlines for large platforms

The DPDP Rules, 2025, notified on 13 November 2025, add specific timelines in Rule 8 and the Third Schedule for three classes of large Data Fiduciary:

• e-commerce entities with at least 2 crore registered users in India
• online gaming intermediaries with at least 50 lakh registered users in India
• social media intermediaries with at least 2 crore registered users in India

For these businesses, personal data must be erased three years after the user last approached the platform or exercised their rights (or from the Rules coming into force, whichever is later), unless another law requires retention. Data needed only so a user can access their account is excluded. At least 48 hours before erasure, the platform must tell the user their data will be deleted unless they log in or get in touch.

Most SMEs will fall well below those thresholds, so this three-year rule will not apply to you directly. It is still a useful benchmark. If the government considers three years of inactivity long enough for a large marketplace, it will be hard to argue that a 40-person D2C brand needs to keep dormant customer profiles for a decade.

The one-year minimum: don't delete too fast

Rule 8(3) adds a counterweight. Every Data Fiduciary, and its Data Processors, must keep personal data, associated traffic data and processing logs for at least one year from the date of processing, for purposes listed in the Seventh Schedule (broadly, state functions and investigations). So your retention policy needs a floor as well as a ceiling.

These retention provisions are part of the obligations that take full effect around 13 May 2027, which leaves roughly six months to design, test and roll out a schedule.

Building a DPDP data retention policy in five steps

1. List your data categories. Customer accounts, order history, payment records, support tickets, marketing leads, CCTV footage, job applicants, employees, vendor contacts. A data inventory from your DPDP Act compliance work is the right starting point.
2. Attach a purpose and a legal basis to each. Why do you hold it, and does any law (Income Tax Act, GST, Companies Act, labour codes, sector regulators) require a minimum period?
3. Set a retention period and a trigger. "Seven years after the financial year of the invoice" is a rule. "As long as needed" is not. Note the one-year log minimum under Rule 8(3).
4. Automate deletion, including at vendors. Configure CRM, helpdesk and cloud storage auto-purge rules, and write deletion obligations into processor contracts. Section 8(7) expressly covers your Data Processors.
5. Record and review. Keep a deletion log, review the schedule yearly, and check it whenever you launch a new product or vendor. A privacy impact assessment is a good moment to test new data flows against the schedule.

A sample entry might read: "Unconverted sales leads: purpose, follow-up on enquiry; retained 12 months from last contact; deleted from CRM and email tool via monthly automated job; owner, Head of Sales."

Where SMEs usually trip up

Three gaps come up again and again in our reviews. First, backups: data deleted from the live system often survives for years in snapshots, so define backup expiry too. Second, spreadsheets and email attachments, which no auto-purge rule touches. Third, former employees, whose KYC documents tend to outlive their tenure by a long way.

Get started

Free Mobile learned the cost of stale data after an attacker found it first. You can fix it on your own schedule. Start with our free DPDP compliance checklist, and if you'd like help drafting a retention schedule that fits your sector's record-keeping laws, talk to our team.

This article is general guidance on the DPDP Act, 2023 and DPDP Rules, 2025, and is not legal advice. Please consult a qualified professional for advice on your specific situation.