Building a practical approach to the end of the personal-data lifecycle
DeepSec Consulting | DPDP Act & GRC Series
A personal-data lifecycle should not end with collection, storage and processing.
Organizations also need to determine when information should no longer be retained.
Keeping unnecessary information indefinitely can increase operational complexity and increase the amount of information exposed if a system, account or storage location is compromised.
Build a Retention Schedule
- Business purpose
- Applicable retention requirements
- Responsible owner
- Retention period
- Archival requirements
- Deletion method
- Approved exceptions
- Evidence of deletion where appropriate
Look Beyond the Main Database
- Backups
- Data exports
- Spreadsheets
- Email attachments
- Employee devices
- Cloud storage
- Application logs
- Archives
- Legacy systems
Practical Case Study: The Deleted Record That Wasn’t Deleted
Scenario: A company deleted a customer’s record from its primary application. Months later, the same information was discovered in monthly exports and a legacy reporting database. The organization’s deletion process covered the production system—but not the secondary repositories.
Lesson: Deletion must be designed across the entire data lifecycle, not just inside the primary application.
What’s Next?
Good lifecycle management reduces unnecessary exposure, but organizations must still prepare for situations where personal data may be compromised. Blog 9 moves into incident readiness and response.
DeepSec Consulting can help organizations assess DPDP readiness, identify privacy and security gaps, and build a practical GRC roadmap aligned with their business environment.
No comments