DPDP Act mandates e-commerce, social media firms to delete inactive user data after 3 years

The government has notified detailed norms under the Digital Personal Data Protection (DPDP) Act, introducing stringent data-retention rules for e-commerce platforms, social media intermediaries and online gaming companies.

Under the new guidelines, platforms will be required to delete the personal data of any user who has not logged in or used the service for three consecutive years.