New Data Privacy Rules Suggest E-Commerce Players, Social Media Platforms Should Delete User’s Info After 3 Years

The draft categorised several types of data fiduciaries and said that entities such as social media networks, and e-commerce platforms should delete user data 3 years after it is not required anymore

The draft rules were made public on January 3, 2025, seeking consultation and shall remain open for feedback till February 18, 2025

Source : Pexels

The rules for the Digital Personal Data Protection Act were revised in a draft for the first time. The draft document categorised several types of data fiduciaries and said that entities such as online gaming services, social media networks, and e-commerce platforms should delete user data in the time period of three years after it is not required anymore.

The draft rules were made public on January 3, 2025, seeking consultation and shall remain open for feedback till February 18, 2025, reported Business Standard. These requirements are highlighted in Section 8 of the draft rules which make it necessary for data fiduciaries to erase personal data when it is no longer needed for its intended purpose.

The Third Schedule of the draft rules specifically mentions the data retention timelines for several data fiduciaries, such as social media platforms, online gaming entities, and e-commerce players.

Such platforms are instructed to notify users at least 48 hours ahead of data deletion so that they have an opportunity to log in or begin contact to retain their information. User accounts include profiles, phone numbers, or email addresses used for accessing the services.

The draft also goes on to define e-commerce platforms as entities with not less than 20 million registered users in the country. Meanwhile, online gaming platforms are defined as those with a user base of 5 million or more, and social media intermediaries are the ones with 20 million users or more in India.

These data fiduciaries must also permit users to access their accounts and provide access to any virtual tokens that could be exchanged for money, services, or goods.

The draft also defined an e-commerce player as ‘any person who owns, operates, or manages a digital facility or platform for e-commerce as defined in the Consumer Protection Act, 2019 (35 of 2019), but does not include a seller offering her goods or services for sale on a marketplace e-commerce entity as defined in the said Act.’