Skip to content

Data Retention

Also called: Retention policy · Retention schedule · Data retention policy · Storage limitation

The rules and schedule for how long chat logs, media, consent records and contact data are kept before deletion once their purpose has been served.

Reviewed

What is data retention?

Data retention is the set of rules, and the schedule that implements them, for how long an organisation keeps each category of data before deleting or anonymising it. For a WhatsApp operation the categories are concrete: message and chat logs, media files customers send, contact profiles and labels, campaign and delivery records, consent records, and the system and audit logs around them. Each needs a period, an event that starts the clock and an action at the end.

Data protection law sets the outer limit. India's DPDP Act requires a Data Fiduciary to erase personal data once the purpose it was collected for is no longer being served, or once consent is withdrawn, unless another law requires it to be kept. The DPDP Rules 2025 add specifics from 13 May 2027: listed large e-commerce, gaming and social media platforms must erase data after three years of user inactivity, warning the user 48 hours before, and logs of processing must be kept for at least a year. For people in the EU, GDPR's storage-limitation principle (Article 5(1)(e)) says the same: no longer than necessary.

Other laws set minimums. GST law requires accounts and invoices to be kept for 72 months from the due date of the annual return, regulated lenders must keep KYC records for set periods, and CERT-In's 2022 directions require ICT system logs to be kept for 180 days in India. A good schedule reconciles both sides: chats about an order can go after the returns and claims period, while the consent record proving a customer agreed to marketing is kept for as long as you rely on it and for a defined period afterwards to answer disputes.

Retention is different from the Right to Erasure. Retention deletes on a timetable for everyone; erasure deletes one person's data because they asked. Both need the same machinery: a job that can find and remove every copy, and a record that it did.

Key takeaways

  • Data retention is the schedule that says how long each kind of WhatsApp data is kept and when it is erased or anonymised.
  • The DPDP Act and GDPR both require erasure once the purpose is served, unless another law requires the data to be kept.
  • Some records must outlive the chat: consent proof, invoices and security logs carry their own minimum periods.
  • Meta keeps Cloud API message data for 30 days at most, so anything you need for longer is yours to store, and to delete.
  • A schedule only counts if a job enforces it across every copy: database, media store, search index, CRM and backups.

See InfiQ pricing

Interactive stop

Trace a nightly retention purge

8 / 8
Whole trace

420 s end to end · 7 spans

Bottleneck: Delete media > 30 days takes 304 s, 72% of the trace. Speeding it up shortens the whole request the most; trimming a span that runs in parallel with it may save nothing.

An illustrative run of the job that enforces a retention schedule: find what has expired, delete every copy in parallel, then write the purge record. The slowest step, deleting media files, is flagged.

Whole trace: 420 s across 7 spans. Bottleneck: Delete media > 30 days, 304 s (72% of the trace).

Data retention: key facts and limits

DPDP Act rule
Erase when the purpose ends or consent is withdrawn
Inactive users (DPDP Rules)
3 years for listed large platforms, 48 hours' warning
Processing logs (DPDP Rules)
Kept for at least one year
CERT-In ICT logs
180 days, maintained in India
GST records
72 months from the annual return due date
Meta Cloud API message data
30 days at most
Media IDs
30 days uploaded, 7 days from webhooks

How does data retention work?

  1. List data categories and purposes

    Chat logs, media, contacts, campaign records, consent records, system and audit logs, each with the purpose it serves and an owner who decides its period.

  2. Find the legal minimums and maximums

    Note where a law requires keeping data (tax, KYC, security logs) and where the purpose ends (order closed, consent withdrawn, account inactive).

  3. Write the schedule

    One row per category: the retention period, the event that starts the clock, the action at expiry (delete or anonymise) and any legal-hold exception.

  4. Enforce it with a job

    Run a scheduled purge that deletes database rows, media objects, search entries and synced CRM copies, and let backups age out on a fixed rotation.

  5. Record what was deleted

    Write a purge record (categories, counts, time) to an audit log so you can show the schedule actually runs.

Data retention in code

-- One row per data category: how long to keep it and what starts the clock.
CREATE TABLE retention_policy (
  category     TEXT PRIMARY KEY,   -- 'chat_message', 'inbound_media', ...
  keep_days    INTEGER NOT NULL,
  clock_starts TEXT NOT NULL,      -- 'conversation_closed_at', 'created_at', ...
  action       TEXT NOT NULL CHECK (action IN ('delete', 'anonymise'))
);
 
INSERT INTO retention_policy VALUES
  ('chat_message',     180, 'conversation_closed_at', 'delete'),
  ('inbound_media',     30, 'created_at',             'delete'),
  ('campaign_record',  365, 'created_at',             'anonymise'),
  ('consent_record',  1095, 'consent_withdrawn_at',   'delete'),
  ('security_log',     365, 'created_at',             'delete');

Illustrative periods: set your own from each category's purpose and the laws that apply to you.

Why does data retention matter?

Every extra month of chat history is extra exposure in a breach and extra work in every access or erasure request, and Meta will not keep it for you: Cloud API message data is held for 30 days at most, uploaded media IDs expire after 30 days and inbound media IDs after 7. A clear schedule keeps what support, finance and legal genuinely need, deletes the rest automatically, and gives a straight answer when an auditor or the Data Protection Board asks how long you keep customer conversations, and why.

Example: A Bengaluru clinic chain's schedule

A Bengaluru clinic chain uses WhatsApp for appointment reminders and report delivery. Its schedule keeps appointment chats for 12 months to settle rescheduling disputes, deletes lab-report PDFs from its WhatsApp media store 30 days after delivery (the report itself stays in the clinical system under medical-records rules), keeps marketing consent records for the life of the consent plus three years, and keeps security logs for a year, covering both CERT-In's 180 days and the DPDP Rules' one-year minimum. A nightly job enforces it and writes a purge record each run, so when a patient asks what is held about them the answer is short.

— A Bengaluru clinic chain's schedule

Common mistakes with data retention

  • Keeping everything just in case

    Indefinite chat history breaks the purpose rule in both the DPDP Act and GDPR and multiplies what a breach exposes. Give every category a period and an owner.

  • Deleting the proof along with the data

    When a subscriber leaves, their consent record and withdrawal are your evidence that you messaged lawfully and stopped when asked. Keep them for a defined period, then delete.

  • A policy with no job behind it

    A schedule in a PDF deletes nothing. Automate the purge, alert when it fails, and review its audit records monthly.

  • Forgetting copies outside the database

    Media buckets, search indexes, CRM syncs, spreadsheet exports, chatbot vendor logs and backups all hold WhatsApp data. Include each in the purge or in a rotation that ages it out.

Best practices for data retention

  • Start the clock from a business event (conversation closed, consent withdrawn), not only the creation date.
  • Anonymise campaign metrics instead of deleting them; aggregate counts carry no personal data.
  • Download inbound media you must keep before its media ID expires; otherwise do not store it at all.
  • Review the schedule every year and whenever a new data category or vendor appears.

Data Retention FAQs

How long should I keep WhatsApp chat logs?+
As long as their purpose needs, then delete them. Many businesses keep support chats for 6 to 12 months to handle disputes, but no single period fits everyone: write the period and the reason into your retention schedule.
Does WhatsApp delete messages from the Cloud API?+
Yes. Meta keeps Cloud API message data for 30 days at most, uploaded media IDs expire after 30 days and inbound media IDs after 7. Anything kept longer is stored by you or your BSP, and your schedule governs it.
What is the difference between data retention and the right to erasure?+
Retention deletes data on a schedule for everyone; the right to erasure deletes one person's data because they asked. Both should run through the same purge job and leave the same audit record.
Should I delete consent records when someone unsubscribes?+
Not straight away. The consent record and the withdrawal prove you messaged lawfully and stopped when asked, so keep them for a defined period after withdrawal, then delete them.

Talk to InfiQ

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms