Personal data moves through a lifecycle — collection, use, storage, sharing and deletion. The DPDP Act imposes duties at each stage, and managing the whole lifecycle (rather than bolting on controls) is what makes compliance sustainable.
Collect
Minimise, give a notice, and get a lawful basis. Don't collect 'just in case'.
Use
Use data only for the stated purpose (purpose limitation). New purposes need a new basis.
Store
Secure it (Rule 6), classify it, and control access. Keep logs for a year.
Share
Only with a basis and a contract; track cross-border flows.
Delete
Erase when the purpose ends or consent is withdrawn — see retention and deletion. Propagate deletion to backups and processors.
A lifecycle checklist
- Minimise and notify at collection
- Enforce purpose limitation in use
- Secure and classify in storage
- Contract and track at sharing
- Automate deletion at end of life
How DPDP Bridge helps
DPDP Bridge helps you manage the whole data lifecycle — from consented collection to automated deletion — with controls built into each stage. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.