Although this framework may appear at first glance to advance privacy protection, it raises significant concerns. The mandatory deletion of dormant accounts risks inadvertently destroying an individual’s digital history—personal records, communications, receipts, and documents that may hold long-term personal or legal value. A 48-hour response window is unreasonably short; a Data Principal may easily miss such a notification, or may be incapacitated, travelling, or otherwise unable to react within the allotted time. Rather than safeguarding individual rights, this provision could result in the irreversible loss of valuable information.

This approach also reflects a deeper conceptual confusion. The government appears to enforce data subject rights with a data fiduciary’s time-bound obligation to delete. Data erasure, under established global privacy norms, is fundamentally a user-driven prerogative—not a rigid, time-bound compliance burden imposed on organisations. Control over the fate of personal data should rest with the Data Principal, not be dictated by an automated regulatory timetable.

GDPR and most contemporary privacy regimes recognise the Right to Erasure as an individual right: personal data must be deleted when it is no longer necessary and when the individual expressly requests its removal. The obligation arises from the individual’s autonomy, not from a statutorily prescribed expiration period. By mandating deletion after a fixed period of inactivity, the DPDP Rules 2025 depart from this rights-based foundation and risk undermining the very autonomy they seek to protect. Lawmakers should not impose an arbitrary duration that automatically deems personal data no longer relevant.

This problem becomes even more pronounced in today’s digital environment. E-commerce receipts are often stored exclusively online within user accounts; warranty documents are maintained digitally; and cloud storage services allow users to keep important personal files, records, and archives in electronic form. A mandatory deletion requirement triggered solely by account inactivity could cause substantial inconvenience and, in many cases, irreversible harm to Data Principals who rely on these digital repositories.

Rule 8, therefore, requires urgent reconsideration. A policy intended to protect privacy should not inadvertently compromise personal autonomy, digital continuity, or the preservation of an individual’s historical and informational legacy.