Here’s Everything You Need To Know About Zero Data Retention

What Is Zero Data Retention (ZDR)?

Zero data retention (ZDR), in simple terms,  means not storing any data intentionally after it has served the immediate purpose. This means the data is deleted as soon as it is no longer needed instead of saving it for any future use.

ChatGPT developer OpenAI has championed this cause by rolling out a ZDR policy in its application programming interface (API) calls. Though the US-based AI decacorn does retain some API data to identify abuse for up to 30 days, users can request ZDR at any time.

How Long Can Companies Store Data?

Data privacy laws vary from country to country. In India, data protection laws broadly come under the ambit of subordinate legislations that were promulgated years after the actual IT Act, 2000 came into force.

The ‘right to be forgotten’’ was introduced by the Personal Data Protection Bill 2018, which entrusts the right of a person to delink, limit, correct, or even delete any information that the user may consider personal or misleading. 

In addition, it is also mandatory for Indian companies, under the Information Technology (Reasonable Practices and Procedures for Processing and Storing of Sensitive Personal Data or Information) Rules, 2011, to delete any sensitive personal data once the purpose is served 

On the other hand, the US does not have a one-size-fits-all data privacy law. Instead, there are several sector-specific regulations on storage, processing, and deletion of personal data.

Why Is ZDR Important For A Startup?

Zero data retention has several potential benefits in various contexts, making it an increasingly attractive approach for startups, organisations, and individuals. Here are some of the key reasons why ZDR is considered important:

Enhanced Privacy

• Reduced Data Footprint: By eliminating data storage, ZDR minimises the potential for unauthorised access, leaks or breaches, protecting individuals’ privacy.
• Control Over Personal Information: Users gain greater control over their data as it isn’t retained for extended periods beyond the immediate purpose. They can choose when and how their data is used, aligning with transparency principles.

Improved Security

• Smaller Attack Surface: With less data stored, potential vulnerabilities through data breaches shrink. This reduces the risk of security incidents and associated costs.
• Compliance With Regulations: ZDR can simplify compliance with evolving data privacy regulations like GDPR and CCPA, which emphasise data minimisation and user control.

Ethical Considerations

• Right To Be Forgotten: ZDR aligns with the ‘right to be forgotten’ principle, allowing individuals to request the removal of their data. It enhances trust and fosters ethical data practices.
• Responsible Data Usage: Encourages conscious collection and use of data, promoting responsible data practices and avoiding unnecessary data hoarding.

Additional Advantages

• Reduced Storage Costs: Eliminating data storage eliminates associated costs, potentially leading to operational efficiencies and resource savings.
• Focus On Present: ZDR fosters a culture of using data for immediate tasks rather than relying on past information, leading to more agile and adaptable decision-making.

What Are The Legal Challenges With Data Retention?

While offering potential benefits for privacy and responsible data use, ZDR presents unique legal challenges in India’s regulatory landscape.

Compliance With Indian Laws

• Sector-Specific Regulations: Industries like telecom, healthcare and finance have individual data retention requirements mandated by respective regulators. ZDR might contradict these, leading to penalties or non-compliance issues.
• Information Technology Act, 2000: While advocating data minimisation, it doesn’t explicitly mandate retention periods. However, specific provisions like Section 43A (reasonable security practices) and Section 72A (disclosure to government agencies) might necessitate data availability, posing challenges for ZDR.
• Digital Personal Data Protection Act: The legislation will address data retention explicitly. Companies implementing ZDR should stay updated on its provisions and potential conflicts.

Balancing Individual Rights And Data Protection

• Right To Be Forgotten: While individuals have the right to request data deletion under the IT Act, ZDR raises questions about proving compliance and handling potential future requests where data is permanently gone.
• Data Subject Access & Rectification: Similar concerns arise with the right to access and rectify personal data, as ZDR might make fulfilling these rights impossible.

Other Legal Considerations

• Evidence In Legal Disputes: Data often serves as crucial evidence in legal proceedings. ZDR could hinder a company’s ability to defend itself or pursue claims if data is unavailable.
• Contractual Obligations: Contracts with clients or partners might stipulate data retention periods. Breaching these terms due to ZDR could lead to legal disputes.
• National Security: Specific industries or situations might involve national security interests, where data retention for a prescribed period might be mandated by law. ZDR could conflict with these requirements.

What Are The Considerations Companies Should Take While Implementing ZDR?

Implementing ZDR requires careful planning and consideration of various logistical aspects. Here are some of the steps Indian companies can take into consideration:

Data Mapping & Inventory

• Identify All Data Flows & Storage Locations: Understand what data your organisation collects, stores, and processes across different systems and applications. This initial mapping is crucial for determining which data can be subject to ZDR.
• Classify Data Based On Sensitivity & Legal Requirements: Categorise data based on its sensitivity level and any associated legal retention obligations. This helps prioritise ZDR implementation for specific data categories.

Technical Infrastructure & Processes

• Develop Data Deletion Methods: Determine how data will be securely deleted across different systems, considering factors like data encryption, anonymisation, and irreversible deletion techniques.
• Integrate Deletion Processes With Business Operations: Align ZDR processes with existing workflows and automate wherever possible to ensure timely and consistent data deletion.
• Implement Monitoring & Auditing Mechanisms: Track data deletion activities and verify their effectiveness to demonstrate compliance and address potential data leaks.

Legal & Regulatory Compliance

• Legal Audit: Assess existing data privacy regulations, industry-specific requirements, and contractual obligations that might impact Zero Data Retention implementation.
• Seek Legal Counsel: Consult with legal experts to ensure your ZDR approach complies with applicable laws and regulations.

Additional Considerations

• Impact On Data Analytics & Machine Learning: Consider the potential impact of ZDR on historical data-driven insights and machine learning models that might rely on past data.
• Cost-Benefit Analysis: Evaluate the potential cost savings from reduced data storage against the investment required for implementing and maintaining ZDR infrastructure.
• Phased Implementation: Start with pilot projects involving less sensitive data or specific departments to gradually gain experience and refine your zero data retention approach.