Sales Data Retention Under DPDP — How Long Can You Keep Leads?

Check your sales data retention risk

How long do you keep unconverted prospect and lead records?

Did prospects consent to their data being kept for ongoing sales contact?

Can a prospect ask you to delete their data, and can you actually do it?

Do you have a written retention schedule for sales/CRM data?

Sales data retention checklist under DPDP

Define a retention period for each sales data category (active leads, dead leads, closed-lost, marketing contacts)
Tell prospects at the point of collection how long you will keep their data and for what purpose
Auto-flag inactive prospect records for review and deletion rather than keeping them forever
Avoid purchased or scraped contact lists — they rarely come with a valid DPDP basis or notice
Build a working erasure process so you can find and delete one specific person on request
Document the whole thing in a written retention schedule that a regulator and your own team can follow

How long can sales legally keep prospect and lead data?

The DPDP Act does not set a single fixed number of years for sales data — instead it applies purpose limitation and storage limitation. Personal data may be kept only as long as it is needed for the purpose it was collected for, and must be deleted once that purpose is served and no legal obligation requires keeping it. For a sales team, that means an active prospect you are genuinely working is fine to retain, but a dead lead that has ignored you for three years no longer has a live purpose justifying its retention.

The practical translation is a retention schedule: define how long each category of sales data is kept — active pipeline, unconverted leads, closed-lost, general marketing contacts — and automatically review and delete records past that point. Indefinite retention of everything, the default state of most CRMs, is precisely what creates DPDP exposure. Niti Bharat helps sales-driven companies set defensible retention periods that keep the pipeline useful without hoarding personal data the law says should be gone.

Consent, erasure and bought lists — the three sales pitfalls

Three retention issues catch sales teams repeatedly. First, consent: a prospect enquiring once does not consent to years of ongoing contact, so be explicit at collection about retention and purpose. Second, erasure: DPDP gives every Data Principal the right to have their data deleted, and a CRM with no way to find and remove one specific person — across records, exports and backups — cannot honour that right within the response window. Third, bought or scraped lists: purchased contact data rarely comes with the valid basis and notice DPDP requires, making it high-risk to process at all.

Getting these right is mostly operational, not legal: a retention schedule, a clear collection notice, and a repeatable erasure workflow. Niti Bharat's fixed-price DPDP engagements (₹75K–₹3.2L depending on scope) include building a sales-specific retention schedule and erasure process, so your revenue team keeps the data it genuinely needs and safely lets go of the data that has become a liability — well before May 2027 enforcement.

Get the sales data retention schedule template (free)

A ready-to-use retention schedule template for sales and CRM data, with recommended review periods per lead category, a collection-notice snippet, and an erasure workflow.

Frequently Asked Questions

Is there a fixed number of years sales data can be kept under DPDP?+

No. The DPDP Act uses purpose and storage limitation rather than a fixed period — you keep personal data only as long as the purpose it was collected for remains live, then delete it. This is why a defined per-category retention schedule, rather than a single number, is the right approach for sales data.

Can we keep a dead lead in case they come back one day?+

Keeping a dead lead indefinitely on the theory they might return is hard to justify under storage limitation, since there is no live purpose. A defensible approach is a defined retention period for inactive leads, after which the record is reviewed and deleted or the prospect is re-consented for continued contact.

Are purchased or scraped lead lists a problem under DPDP?+

Yes — bought or scraped personal data rarely comes with the valid basis and notice DPDP requires, so processing it is high-risk. If you use third-party data, you need to be able to show a lawful basis and provide the required notice, which most purchased lists cannot support.

What if a prospect asks us to delete their data?+

You must be able to honour it. DPDP gives Data Principals the right to erasure, so sales needs a repeatable way to find and delete one specific person across the CRM, exports and backups within the response window. A slow, manual process is a common complaint trigger — build it to be repeatable.

Quick Answer