Draft rules under India's Digital Personal Data Protection (DPDP) Act require large e-commerce, gaming, and social media platforms to delete user data after three years unless needed. Platforms must notify users 48 hours prior to deletion, allowing data retention requests. The rules also outline data breach notification procedures and security safeguards.
