DPDP and End-of-Life IT Assets: What the Act and Rules Actually Require

The short version

The DPDP Act does not mention laptops, hard drives or e-waste. It does not need to. It makes you responsible for personal data in your possession or under your control, and it asks you to protect it and erase it once its purpose is served. A retired laptop in a storeroom is still in your possession. A drive handed to a buyer without being wiped is data you no longer control.

Retired devices are still in your possession

Section 8(5) of the Act requires a Data Fiduciary to protect personal data in its possession or under its control, including data processed by its processors, by taking reasonable security safeguards to prevent a breach. The Schedule to the Act sets the maximum penalty for failing to do so at ₹250 crore.

Rule 6 of the DPDP Rules, 2025 spells out what reasonable safeguards include at a minimum: encryption or similar measures, access controls, logs and monitoring, backups for continuity, contract terms with processors, and appropriate technical and organisational measures. It does not name device disposal, but a drive that leaves your building unwiped fails most of that list at once.

Your disposal vendor matters here too. If a vendor handles personal data on your behalf, it is acting as your Data Processor, and Rule 6 expects security terms in your contract with it.

Erase, but not too early

Section 8(7) requires you to erase personal data once consent is withdrawn or it is reasonable to assume the purpose is no longer served, unless a law requires you to keep it, and to make your processors erase it too.

The Rules add a counterweight that many IT teams miss. Rule 8(3) requires every Data Fiduciary to retain personal data, the associated traffic data and logs of processing for at least one year from the date of processing, unless another law needs longer. Rule 6 asks for logs to be kept for a year as well.

So the order matters. Confirm that the records you must keep have been retained or migrated, then retire the device and destroy the data on it. Wiping a server the week after a project ends can breach the retention rule just as surely as leaving it unwiped breaches the security rule.

When each duty applies

The DPDP Rules were notified on 13 November 2025 and announced by PIB the next day. They apply in stages:

• 13 November 2025: definitions and the Data Protection Board.
• 13 November 2026: registration of Consent Managers.
• 13 May 2027: notice, security safeguards, breach intimation, erasure and retention, children’s data, rights and grievance redressal.

Devices you retire today will still be sitting in someone’s hands, or a landfill, in May 2027. The records you create now are the ones you will be asked for then.

The evidence to keep

• An asset register that shows which devices held personal data.
• A retention decision for each system before it is retired.
• Per-drive erasure reports or destruction certificates listing serial numbers.
• The handover record, such as a signed pickup manifest.
• Your contract with the disposal vendor, including security terms.

Five steps for IT teams

1. Flag data-bearing devices in the asset register, including printers, CCTV recorders and phones.
2. Before retiring a system, confirm the one-year retention rule and any sector rules are met.
3. Choose the method per media: verified wiping for reuse, degaussing for hard drives and tape, shredding for anything that must never work again. Degaussing does not work on SSDs.
4. Get certificates that name each device, not just a count.
5. File everything where an auditor or the Data Protection Board could ask for it.