DATA RETENTION & DELETION POLICY
Nasha Mukt Bihar Campaign
Effective Date: 15 September 2026
Last Updated: 15 September 2026
1. Purpose
This policy establishes principles for retaining, deleting and anonymising information collected through the Nasha Mukt Bihar digital platform.
The Campaign does not intend to retain personal or sensitive information indefinitely without a defined purpose.
2. Retention Principles
Information should be retained only when reasonably necessary for:
- the purpose for which it was collected;
- ongoing Campaign administration;
- certificate verification;
- legal obligations;
- security;
- fraud prevention;
- dispute resolution;
- legitimate archival purposes.
When information is no longer required, it should be securely deleted, anonymised or otherwise disposed of according to applicable requirements.
3. Indicative Retention Schedule
The following framework may be applied and reviewed periodically.
| Data Category | Indicative Retention |
|---|---|
| Active membership | While membership remains active/relevant |
| Revoked/rejected membership | As necessary for fraud, audit and legal purposes |
| Certificate verification record | For certificate verification lifecycle |
| Certificate files | For the certificate’s operational/verification lifecycle |
| Event registration | Event lifecycle + reasonable administrative period |
| Attendance | As required for participation verification |
| Verified activities | Campaign reporting/archival lifecycle |
| Unverified activities | Shorter operational period |
| Help requests | Shortest practical operational period |
| Centre reports | Until investigation/resolution + reasonable audit period |
| Security events | Defined security monitoring period |
| Audit logs | Defined compliance/security retention period |
| Notification logs | Operational/debugging period |
| Temporary uploads | Until processing or defined expiry |
Actual retention periods may be adjusted based on legal, operational and security requirements.
4. Sensitive Information
Information relating to:
- addiction;
- recovery;
- counselling;
- treatment;
- medical circumstances;
- family support requests
should receive stricter retention controls.
Where the operational purpose has ended, such information should be deleted or anonymised as soon as reasonably practicable, subject to applicable legal requirements.
5. Security Logs
Security logs may contain technical information such as:
- IP address;
- request information;
- security events;
- authentication events.
These records should not be retained indefinitely.
Retention should reflect the purpose of detecting, investigating and responding to security incidents.
6. Certificate Records
Certificates may need longer-lived verification records because the public authenticity of an issued certificate may need to be established after issuance.
The public verification record should contain only the minimum information necessary to verify the certificate.
7. Deletion
Deletion may occur through:
- automated retention jobs;
- administrative review;
- account deletion workflows;
- secure storage lifecycle rules;
- manual deletion where necessary.
Deletion should be performed securely and consistently with backup systems.
8. Backups
Information deleted from the active database may remain temporarily in encrypted backups. Backup copies should expire according to the applicable backup lifecycle.
Backups should not be restored solely to recreate information that has already been intentionally deleted unless required for disaster recovery or legal reasons.
9. Anonymisation
Where complete deletion is impractical or unnecessary for legitimate statistical purposes, personal information may be anonymised.
Anonymised statistical information should not reasonably identify an individual. Examples include aggregate counts of:
- members by district;
- Sankalps;
- verified activities;
- event participation;
- rehabilitation-centre searches.
10. Data Subject Requests
Individuals may request appropriate access, correction, deletion or other legally applicable action regarding their personal information.
Requests may be subject to identity verification and legal limitations.
11. Review
Retention schedules should be reviewed periodically. New features must consider retention requirements before collecting new categories of information.
12. Contact
Email: help@nashaMuktbihar.in
Phone: 9430001970
© 2026 Nasha Mukt Bihar Campaign.