Data Retention and Disposal Policy

Policy Statement

The Company recognizes the importance of managing data effectively throughout its lifecycle. This Data Retention and Disposal Policy establishes guidelines for the secure retention, archiving, and disposal of records and information in compliance with applicable legal, regulatory, and business requirements, including the Digital Personal Data Protection (DPDP) Act, 2023, and industry best practices.

Objectives

• Ensure proper management of data throughout its lifecycle, from creation to disposal.
• Retain data only for as long as necessary to meet business, legal, or regulatory requirements.
• Dispose of data securely to prevent unauthorized access, loss, or misuse.
• Support compliance with data protection and privacy laws, including GDPR and the DPDP Act.

Scope and Applicability

This policy applies to all business units, employees, contractors, vendors, and third parties handling Company data in any form, electronic, physical, or cloud-based. It covers all categories of data, including personal, financial, operational, and confidential business information.

Data Retention Principles

• Purpose Limitation: Data shall be retained only for the specific purpose for which it was collected.
• Legal Compliance: Data retention must adhere to applicable laws and contractual obligations.
• Data Minimization: Retain only the minimum data necessary for legitimate business purposes.
• Storage Limitation: Data shall not be retained beyond its required retention period unless mandated by law.
• Security: Retained data shall be stored securely and protected from unauthorized access or alteration.

Data Retention Schedule

Each department is responsible for identifying the specific categories of data it manages and defining corresponding retention periods. Typical retention periods include:

• Employee Records: 7 years after separation or as per labor laws.
• Financial and Accounting Data: 8 years from the end of the financial year.
• Customer and Vendor Records: Retained for the duration of the relationship plus 5 years.
• Legal and Contractual Documents: Retained as required by the Companies Act or applicable laws.
• Electronic Logs and System Data: Retained for 1 to 3 years, depending on system requirements.
• Personal Data: Retained as long as consent is valid or necessary for the purpose collected.

Data Archiving

Data that is no longer actively used but must be retained for legal or regulatory purposes shall be archived securely. Archived data shall be protected with restricted access and encryption to prevent unauthorized use or disclosure.

Data Disposal Procedures

Once the retention period has expired, data shall be disposed of securely using approved methods that ensure complete destruction and prevent reconstruction.

• Digital Data: Secure deletion using certified wiping tools or degaussing to ensure irrecoverability.
• Physical Documents: Shredding or incineration under supervision of authorized personnel.
• Cloud Data: Permanent deletion through verified service provider processes in line with contractual clauses.

Roles and Responsibilities

• Board of Directors: Approve and oversee implementation of this policy.
• Data Protection Officer (DPO): Ensure compliance with data protection regulations and monitor retention schedules.
• Department Heads: Identify and classify data within their departments and apply appropriate retention timelines.
• Employees: Follow retention and disposal procedures and report any deviations immediately.

Monitoring and Audit

The Compliance and IT Departments shall conduct periodic audits to ensure adherence to data retention and disposal requirements. Non-compliance shall be addressed through corrective actions and disciplinary measures, where applicable.

Legal and Regulatory Compliance

This policy aligns with applicable laws, including the Companies Act, 2013, Income Tax Act, 1961, DPDP Act, 2023, and GDPR. Where specific laws mandate longer retention periods, such requirements shall take precedence.

Policy Review

This policy shall be reviewed annually or upon changes in applicable legal or business requirements. Revisions must be approved by the Board of Directors and communicated to all relevant stakeholders.

Employee Acknowledgment

I acknowledge that I have read and understood the Data Retention and Disposal Policy of the Company I agree to comply with the procedures outlined and to handle Company data responsibly throughout its lifecycle.

Employee Name: __________________________

Signature: ______________________________

Date: _________________________________