Document Overlap
3.3%
← Content Overlap Report
A-042
→
First documentHandling Legacy Data Collected Before DPDP: A Board-Level PlanOpen original ↗
A-072
Second documentRight to Erasure for Ecommerce in India: Returns, Refunds,Open original ↗
Low overlap
Top paragraph overlap
13.4%Page comparison
Paragraph matches
Strongest non-zero match for each paragraph.
First paragraph300 words
Executive checklist and common questions on DPDP legacy data
DPDP sits alongside, not above, sectoral and general laws that impose record-keeping duties. If RBI, SEBI, IRDAI, TRAI, or tax statutes require you to retain certain records for a defined number of years, you generally must continue to hold that data even if a Data Principal withdraws consent or asks for erasure, to the extent necessary to meet those legal obligations. Under DPDP, this can operate as a lawful basis under the category of compliance with law or legitimate uses. However, that does not give you a free licence to use the same data for unrelated purposes, such as marketing or broad profiling, once consent is withdrawn or the original purpose has been served. The practical approach is to build and maintain a retention schedule that clearly maps each category of data to its governing laws and minimum retention periods, ensure that fields kept solely for statutory purposes are segregated and access-controlled, and delete or anonymise non-essential fields when they are no longer needed. Where sectoral regulators issue their own privacy or cyber guidelines, align your legacy data programme with those expectations as well, so that you can show both the Data Protection Board and your primary regulator that you have reconciled the two regimes in a thoughtful, documented way. [2] Digital Personal Data Protection Act, 2023 - Ministry of Electronics and Information Technology, Government of India DPDP Rules, 2025 Notified – A Citizen-Centric Framework for Privacy Protection and Responsible Data Use - Press Information Bureau, Government of India Decrypting India’s New Data Protection Law: Key Insights and Lessons Learned - Bird & Bird Top 10 operational impacts of India’s DPDPA – Individual rights - International Association of Privacy Professionals (IAPP) Summary of DSCI’s submission to MeitY on Draft Digital Personal Data Protection Rules, 2025 - Data Security Council of India
13.4%
Second paragraph46 words
Common questions about erasure for ecommerce leaders
No one can require you to violate other laws. If GST, income-tax, accounting, or banking rules require you to keep certain records for a defined period, you may retain that data despite an erasure request, provided you restrict its use to those legal purposes only.
First paragraph198 words
Executive checklist and common questions on DPDP legacy data
No. DPDP does not require blanket deletion of all historical personal data. What it demands is that any personal data you retain has a clear, current lawful basis, is used for specified and legitimate purposes, and is not kept longer than necessary for those purposes or for compliance with law. In many cases, you will need to continue holding certain records to meet tax, corporate, employment, financial sector, or other statutory obligations. For high-value datasets that support fraud prevention, risk management, or essential analytics, you may be able to justify retention under DPDP when combined with appropriate notices, access controls, and defined retention windows. The real target for deletion or strong anonymisation is low-value, high-risk legacy data: old marketing lists with poor consent trails, redundant copies of customer records, unstructured archives that are rarely used, or aged logs that no longer serve a clear operational or legal purpose. Where it is impossible or impractical to reach Data Principals to provide DPDP-grade notices – for example, because contact details are obsolete – you should be cautious about continuing to use that data for discretionary purposes such as marketing, and should seriously consider anonymising or retiring it instead.
8.7%
Second paragraph41 words
Common questions about erasure for ecommerce leaders
Purchase history that feeds into tax, accounting, and fraud obligations may need to be kept for several years, aligned with statutory requirements. Beyond that, keeping detailed, identifiable histories indefinitely generally conflicts with DPDP’s expectation of storage limitation and purpose limitation.