DPDPA 2023 and IT Asset Disposal: Why Deleting Files Is Not Data Destruction

Updated: October 26, 2026 · 16 min read

With the Digital Personal Data Protection Act, 2023 (DPDPA) rules still being finalised by MeitY through 2025 and enforcement infrastructure taking shape in 2026, Indian organisations face a closing window to align their IT asset disposal (ITAD) workflows with the law’s storage limitation requirements. The question most IT and compliance teams are getting wrong is a deceptively simple one: when a device is retired, has the personal data on it actually been destroyed — or merely hidden? The answer has ₹250 crore in penalties riding on it.

The DPDPA’s Erasure Duty: What Section 8(7) Actually Requires

Section 8(7) of the Digital Personal Data Protection Act, 2023 is the statutory anchor for data erasure in India. It reads, in substance, that a data fiduciary must erase personal data — and cause data processors to erase it — as soon as the specified purpose for which it was collected has been fulfilled and retention is no longer required by law. This is not a soft obligation. It is a positive duty to destroy, not merely to stop accessing.

The practical implication for IT asset managers is direct: a decommissioned laptop, a retired server, or a storage array pulled from a data centre rack all carry residual personal data — employee records, customer databases, authentication tokens, cached email — that fall squarely within the DPDPA’s definition of “personal data.” Retaining that hardware without verified erasure, even in a locked storeroom, constitutes continued possession of personal data beyond its lawful purpose. That is a breach of Section 8(7) from the moment the purpose ceases, not from the moment someone exploits the data.

The Act does not specify a technical erasure standard by name. However, MeitY’s broader digital security posture — including its alignment with CPCB’s e-waste framework and international data security practice — makes clear that “erasure” means rendering data unrecoverable by any reasonably foreseeable means. That is a technical standard, not an administrative one, and it rules out every file-deletion method available natively in Windows, macOS, or Linux.

₹250 Crore: Why DPDPA Section 33 Should Be on Every CIO’s Risk Register

Section 33 of the DPDPA 2023 establishes the penalty framework. The Data Protection Board of India — the adjudicatory body created under the Act — can impose financial penalties up to ₹250 crore for a breach of the data fiduciary’s obligations under Section 8, which includes the erasure duty. For Significant Data Fiduciaries (SDFs), breaches involving inadequate security safeguards attract the full ceiling. For other fiduciaries, the penalty band under Schedule 1 of Section 33 ranges from ₹50 crore to ₹200 crore depending on the nature and scale of the violation.

These are not theoretical figures. The DPDPA’s penalty architecture was deliberately calibrated to match the scale of Indian enterprises — and to exceed the cost of compliance. A company that disposes of 500 retired laptops without verified data destruction is not making a technical oversight; it is creating an unquantified liability that sits on its balance sheet until either a breach occurs or an audit surfaces it. With the Data Protection Board expected to be constituted and operationally active through 2026, that window of invisibility is narrowing.

Indian CFOs should note a further financial dimension: if a personal data breach results from inadequately sanitised retired hardware, the organisation may also face reputational claims, contractual penalties from enterprise clients (particularly multinational companies whose data processor agreements reference ISO 27001 or SOC 2 standards), and potential Securities and Exchange Board of India (SEBI) scrutiny under BRSR Core disclosure requirements if the company is a listed entity. The ITAD decision is no longer a facilities or IT operations call — it is a board-level risk item.

Why Format and Delete Is Not Data Destruction

The persistence of the “format and delete” myth inside Indian IT departments is one of the most commercially dangerous misconceptions in enterprise operations today. When a user deletes a file or even performs a full OS format, the operating system marks the relevant sectors as available for overwriting — it does not zero them, overwrite them with random data, or physically alter the magnetic or flash memory substrate. Until those sectors are actually overwritten by new data, the original content is recoverable using tools that are freely available, costs nothing, and require no specialist skill.

For hard disk drives (HDDs), this has been established forensic fact since the early 2000s. For solid-state drives (SSDs) and NAND flash storage — the dominant storage medium in devices purchased in India since 2019 — the situation is arguably worse. SSDs use wear-levelling algorithms that deliberately distribute writes across the entire storage medium, meaning a targeted overwrite of “used” sectors does not touch the sectors the controller has marked as spare. A forensic image of a “formatted” SSD will frequently yield recoverable data across 40–70% of its capacity.

NVMe drives in enterprise servers, eMMC chips in tablets, and LPDDR memory with persistent characteristics all present similar risks. The implication: any IT asset decommissioning policy that relies on OS-level deletion, factory reset, or even single-pass overwrite tools does not meet a defensible standard of DPDPA data destruction in India, regardless of what the software vendor’s marketing material claims.

NIST SP 800-88: The Three Sanitisation Tiers That Matter

NIST Special Publication 800-88 (Guidelines for Media Sanitisation), published by the US National Institute of Standards and Technology and widely adopted internationally, provides the most operationally useful framework for ITAD professionals. While not a statutory Indian standard, it is referenced by i-SIGMA (the global ITAD governance body), aligned with ISO/IEC 27040 (storage security), and consistent with the technical intent of MeitY’s data security advisories. Indian organisations contracting with US, EU, or UK multinationals will typically find NIST 800-88 named in their data processor agreements.

The publication defines three sanitisation tiers:

Sanitisation Tier	Method	Suitable For	DPDPA Defensibility
Clear	Overwrite with standard write commands (software tools)	HDDs reused within the same organisation	Low — not appropriate for third-party disposal
Purge	Cryptographic erasure, ATA Secure Erase, block erase for SSDs	HDDs/SSDs being resold or donated; NVMe drives	Medium-High — requires verified logs and certificate
Destroy	Physical shredding (HDD: ≤ 2 mm particles), degaussing + shred, disintegration	All assets exiting the organisation permanently; classified / sensitive personal data	Highest — gold standard for DPDPA data destruction in India

For assets containing health data, financial data, or UID/Aadhaar-linked records — categories that attract the highest sensitivity under the DPDPA — the Destroy tier should be the organisational default unless there is a documented commercial reason (and a corresponding technical certification) for choosing Purge. The Certificate of Destruction issued after physical shredding creates a contemporaneous record that the Data Protection Board can inspect; a software log alone, without a chain-of-custody document, is a materially weaker evidentiary position.

The Dual Compliance Trap: DPDPA Meets the E-Waste (Management) Rules, 2022

Here is the compliance dimension that most Indian legal and IT teams are handling in separate silos — to their detriment. A decommissioned server or laptop is not just a data liability under the DPDPA 2023. It is simultaneously a piece of electronic waste regulated under the E-Waste (Management) Rules, 2022, notified by the Ministry of Environment, Forest and Climate Change (MoEFCC) and enforced by the Central Pollution Control Board (CPCB).

Rule 16 of the E-Waste (Management) Rules, 2022 places a specific obligation on bulk consumers — which includes any corporate establishment, government body, or institution that uses IT equipment — to ensure that end-of-life electrical and electronic equipment (EEE) is channelled exclusively to authorised dismantlers or recyclers. Channelling e-waste to an unauthorised scrap dealer to save cost is a violation regardless of whether data was first erased or not. Conversely, sending IT assets to a certified ITAD vendor for data destruction but one that is not CPCB-authorised for e-waste processing creates the mirror problem: the data obligation is met but the environmental one is not.

The practical resolution is to use an ITAD partner that holds both credentials: a verifiable data destruction process (aligned to NIST 800-88 Purge or Destroy tier) and CPCB authorisation under the E-Waste Rules. Our CPCB-authorised e-waste recycling service addresses both obligations in a single engagement, issuing both the Certificate of Destruction for DPDPA purposes and the e-waste recycling certificate required under Rule 16 for your BRSR and internal compliance records. Additionally, organisations generating hazardous electronic components such as CRT monitors or lead-acid batteries must also account for the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016, which governs the handling and disposal of such materials and adds a third compliance layer for legacy equipment.

Significant Data Fiduciaries: MeitY’s Higher Bar and What SDFs Must Do Now

Section 10 of the DPDPA 2023 empowers the Central Government to notify certain data fiduciaries as “Significant Data Fiduciaries” (SDFs) based on the volume and sensitivity of personal data processed, national security risk, and potential impact on the rights of data principals. MeitY has indicated that large technology platforms, telecom companies, insurance and banking firms, and healthcare providers are likely candidates for SDF notification as the rules mature in FY 2026-27.

SDFs carry obligations that go materially beyond standard fiduciary duties. They must appoint a Data Protection Officer (DPO) based in India, conduct periodic Data Protection Impact Assessments, and engage an independent data auditor. Critically for ITAD purposes, the SDF’s storage limitation policy must be documented, periodically reviewed, and demonstrably enforced — meaning an SDF that cannot produce records of hardware disposal, including Certificates of Destruction for retired storage devices, is in a structurally weaker position before the Data Protection Board than a standard fiduciary.

For SDF compliance officers, the practical takeaway is this: data destruction must be treated as an auditable process, not a one-time event. The chain of custody from asset retirement to verified destruction — asset tag, collection receipt, erasure/destruction log, Certificate of Destruction — must be retained and producible. Given that MeitY aligns broadly with the data security frameworks used by the Bureau of Indian Standards (BIS) under IS/ISO/IEC 27001, organisations holding BIS certification should ensure their ISMS scope explicitly covers the ITAD process and that their ITAD vendor’s practices are formally assessed in the annual supplier evaluation cycle.

The 7-Step ITAD Compliance Checklist for FY 2026-27

The following checklist is structured around the obligations that Indian data fiduciaries and bulk consumers of IT equipment face under the DPDPA 2023 and the E-Waste (Management) Rules, 2022 in the current financial year. IT asset managers, DPOs, and procurement leads should treat this as a minimum-viable framework, not a ceiling.

1. Conduct a hardware inventory audit. Identify all storage-bearing assets (laptops, desktops, servers, NAS arrays, mobile devices, photocopiers with internal drives) that are retired or due for retirement in Q3–Q4 FY 2026-27. Tag each asset with its data classification level (personal data, sensitive personal data, non-personal).
2. Classify by sanitisation tier. Apply NIST SP 800-88 criteria: assets carrying sensitive personal data (health, financial, Aadhaar-linked) go to the Destroy tier; assets being internally redeployed may use Purge with verified logs. Document the classification decision and the justification.
3. Select a dual-credentialled ITAD vendor. Confirm in writing that your vendor holds (a) a documented NIST 800-88-aligned destruction process with third-party validation and (b) CPCB authorisation under the E-Waste (Management) Rules, 2022 as a dismantler or recycler. Request the authorisation certificate number.
4. Establish a chain of custody from point of collection. Each asset must be covered by a signed collection receipt, a serialised asset tag record, and a tamper-evident seal or locked transport container. The gap between asset leaving your premises and destruction being certified is the highest-risk window.
5. Obtain a Certificate of Destruction for every batch. The certificate must identify: asset serial numbers or batch manifest, destruction method used, date and location of destruction, and the vendor’s authorisation reference. This document is your primary evidence before the Data Protection Board.
6. Update your Records of Processing Activities (RoPA). Under DPDPA good practice (and aligned with MeitY’s draft Rules), fiduciaries are expected to maintain records that reflect the erasure of personal data. Mark retired devices as “data destroyed — [date] — [Certificate reference]” in your asset management system.
7. Review your data processor agreements with ITAD vendors. Section 8(2) of the DPDPA 2023 requires data fiduciaries to engage processors only through a valid contract that mandates the processor to implement “appropriate technical and organisational measures.” Your ITAD contract must explicitly reference data destruction obligations, audit rights, and liability for any data breach arising from inadequate sanitisation.

Related Articles

• Depollution of End-of-Life Vehicles: The Technical Standard RVSFs Are Audited Against
• End-of-Life Vehicle Rules for Bulk Fleet Owners: Compliance Obligations You Cannot Delegate

Frequently Asked Questions

Does the DPDPA 2023 specify a technical standard for data destruction?

The Act itself does not name a specific technical standard such as NIST SP 800-88 or ISO/IEC 27040. However, Section 8(7) requires that data be erased once the purpose is fulfilled, and Section 8(5) requires “appropriate technical and organisational measures” to ensure security. MeitY’s broader regulatory posture, combined with international data processor agreements operative in India, effectively points towards NIST 800-88 Purge or Destroy tier as the defensible minimum for assets leaving organisational control. Organisations that rely on OS-level deletion and cannot produce independent verification face a materially weaker position before the Data Protection Board.

What is the maximum fine for failing to erase personal data under the DPDPA?

Under Section 33(2) of the Digital Personal Data Protection Act, 2023, the Data Protection Board of India can impose a financial penalty of up to ₹250 crore for breach of the data fiduciary’s obligations under Section 8 — which includes the storage limitation and erasure duty in Section 8(7). For breaches involving inadequate data security safeguards by a Significant Data Fiduciary, the ceiling is also ₹250 crore. Penalties for other categories of breach under the Act range from ₹50 crore to ₹200 crore depending on the nature of the violation as specified in Schedule 1 of Section 33.

Are retired laptops and servers regulated as e-waste in India, and who enforces that?

Yes. Laptops, desktops, servers, tablets, and storage devices are covered under Schedule I of the E-Waste (Management) Rules, 2022, notified by MoEFCC and enforced by the Central Pollution Control Board (CPCB) and State PCBs. Rule 16 obliges bulk consumers — any corporate or institutional user of IT equipment — to channel end-of-life devices only to CPCB-authorised dismantlers or recyclers. Disposal through unauthorised scrap channels is a violation irrespective of whether data was first erased. The CPCB maintains a public register of authorised e-waste processors at its e-waste portal.

What is a Certificate of Destruction and why does it matter for DPDPA compliance?

A Certificate of Destruction (CoD) is a formal document issued by an ITAD vendor confirming that specified storage assets have been sanitised or physically destroyed to a defined standard, on a specified date, at a specified facility. For DPDPA 2023 compliance, the CoD serves as contemporaneous evidence that the data fiduciary fulfilled its Section 8(7) erasure duty. It should include asset serial numbers or a batch manifest, the destruction method applied, the vendor’s authorisation credentials, and the date of destruction. Without a CoD, an organisation has no verifiable record to present to the Data Protection Board or to a client conducting a supplier audit.

Who qualifies as a Significant Data Fiduciary under the DPDPA and when will MeitY notify them?

Section 10 of the Digital Personal Data Protection Act, 2023 empowers the Central Government to classify data fiduciaries as Significant Data Fiduciaries (SDFs) based on the volume and sensitivity of personal data processed, potential harm to data principals, national security risk, and impact on sovereignty. MeitY has not yet published a final list of notified SDFs as of October 2026, but the framework indicates that large digital platforms, telecom operators, health-data processors, and financial services companies are the most likely initial cohort. SDFs face additional obligations including a mandatory India-based DPO, Data Protection Impact Assessments, and annual independent data audits.

Work With The National Recycling Corporation

The National Recycling Corporation is a Mumbai-headquartered scrap trading and recycling company with pan-India operations across Maharashtra, Karnataka, Telangana, Tamil Nadu, Delhi-NCR, and Gujarat. For organisations managing DPDPA data destruction obligations alongside their IT asset retirement cycles, we provide a single-vendor solution that eliminates the gap between data security and environmental compliance.

Our ITAD engagements cover physical hard drive shredding and degaussing aligned to NIST SP 800-88 Destroy and Purge tiers, full chain-of-custody documentation, Certificates of Destruction serialised against asset manifests, and CPCB-authorised e-waste recycling under the E-Waste (Management) Rules, 2022. Every engagement is invoiced under a GST-compliant document, with fair-market residual value (indexed to LME rates for recovered metals) credited against disposal costs where applicable. For listed entities, we can provide BRSR-grade documentation of recycled e-waste tonnage and materials recovered, supporting your ESG disclosure obligations.

If you are a data fiduciary, an Significant Data Fiduciary, or a procurement head reviewing your ITAD vendor panel for FY 2026-27, we encourage you to contact us for a no-obligation compliance assessment. You can also read more about our broader e-waste recycling and management services and our EPR compliance support for producers and bulk consumers.

• Pan-India pickup scheduling with tamper-evident logistics across 15+ cities
• Physical hard drive destruction (shredding to ≤ 2 mm particle standard) with video-witnessed destruction on request
• CPCB-authorised e-waste recycling partners — dual compliance under DPDPA and E-Waste Rules, 2022
• Certificate of Destruction issued per batch, with full asset manifest reference
• GST-compliant invoicing; residual metal value credited against service cost
• BRSR-grade recycling tonnage documentation for listed entities
• Audit-ready chain-of-custody records retained for 3 years for regulatory inspection

Sources and References

• Ministry of Electronics and Information Technology (MeitY) — Digital Personal Data Protection Act, 2023 and Draft Rules
• Central Pollution Control Board (CPCB) — E-Waste Management Rules, 2022 and authorised recycler registry
• Ministry of Environment, Forest and Climate Change (MoEFCC) — E-Waste (Management) Rules, 2022 Gazette Notification
• CPCB — Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016
• Bureau of Indian Standards (BIS) — IS/ISO/IEC 27001 Information Security Management Standard
• NIST Special Publication 800-88 Rev. 1 — Guidelines for Media Sanitisation (US NIST)
• Securities and Exchange Board of India (SEBI) — BRSR Core framework circular dated 12 July 2023
• Press reports on DPDPA enforcement and MeitY rulemaking — Business Standard and Economic Times ESG desk, 2025–2026