The GDPR does not set a fixed data retention period. It requires you to keep personal data only for as long as you actually need it to fulfill the purpose you collected it for, and then to delete or anonymize it. Every organization has to define its own retention periods, document the reasoning, and communicate them to the people whose data it holds. Getting this wrong falls under the GDPR’s higher penalty tier, with fines reaching €20 million or 4% of global annual turnover.
The “No Longer Than Necessary” Rule
Article 5(1)(e) of the GDPR sets out storage limitation as a core processing principle: personal data must be kept in a form that allows identification of individuals for no longer than necessary for the purposes it was collected.1gdpr-info.eu. Art. 5 GDPR Principles Relating to Processing of Personal Data The regulation deliberately avoids naming a number of days, months, or years, because “necessary” depends on what you are doing with the data.
Storage limitation sits alongside the data minimization principle in Article 5(1)(c), which limits you to data that is adequate, relevant, and limited to what you actually need. The UK’s Information Commissioner’s Office puts it plainly: you cannot collect personal data “on the off-chance that it might be useful in the future.”2ICO. Principle (c): Data Minimisation If the data should not have been collected at all, no retention period fixes that.
Working Out What “Necessary” Means for Your Data
Because there is no default number, you have to justify every period you set. Four factors drive the analysis.
The Purpose You Collected the Data For
Start with why the data was collected. Once that purpose has been served, the clock has run. Customer data collected to fulfill an order stops being necessary for that purpose once the order is delivered and the return window closes. Data collected for a specific marketing campaign has no purpose once the campaign ends and no ongoing consent supports further use. Recital 39 tells controllers to set time limits for erasure or for periodic review precisely so that data is not held longer than needed.3gdpr-info.eu. Recital 39 Principles of Data Processing
Legal Obligations That Force You to Keep Records
Other laws frequently require you to retain specific records for fixed periods, and those obligations override the general “no longer than necessary” test. The specifics depend on jurisdiction and industry. Tax authorities across the EU commonly require financial records to be kept for six to ten years. Employment rules in some member states dictate how long payroll and personnel records must be held after an employee leaves. Anti-money laundering rules typically demand five years of transaction records after a business relationship ends. If you operate in more than one member state, map these obligations country by country, because they diverge.
These external requirements set a floor for the categories of data they cover. They do not give you cover to keep other personal data past its purpose.
Potential Legal Claims
Data you might need to establish, exercise, or defend a legal claim can be kept for as long as those claims remain viable. That usually tracks the applicable limitation period. Across EU member states, limitation periods for contract disputes commonly run three to six years, and some jurisdictions allow longer. The discipline is identifying which claims could realistically arise and keeping only the data that is actually relevant to them.
The Archiving and Research Exception
Article 5(1)(e) carves out one exception: data stored solely for public-interest archiving, scientific research, historical research, or statistical purposes can be kept longer, provided you put appropriate safeguards in place such as pseudonymization and strict access controls.1gdpr-info.eu. Art. 5 GDPR Principles Relating to Processing of Personal Data This is a narrow route, not a way to rebrand routine data hoarding. Regulators scrutinize reliance on the exception where no genuine research or archiving activity supports it.
Telling People How Long You Keep Their Data
Setting a retention period is only half of the obligation. Article 13 requires that when you collect personal data directly from someone, you disclose either the specific retention period or the criteria you use to determine it.4gdpr-info.eu. Art. 13 GDPR Information to Be Provided Where Personal Data Are Collected From the Data Subject The same duty applies under Article 14 when you obtain the data indirectly.
Boilerplate like “we keep your data as long as necessary” does not meet the transparency standard. A privacy notice needs to break data into categories and either state a concrete period (“we delete account data two years after your last login”) or set out the criteria clearly (“we retain transaction records for the duration required by applicable tax law”). Supervisory authorities have repeatedly flagged vague retention disclosures as a compliance failure.
When Someone Asks You to Delete Their Data Sooner
Individuals do not have to wait out your retention clock. Article 17 gives them a right to request erasure, and you must comply without undue delay when certain conditions apply. The most common triggers are that the data is no longer necessary for its original purpose, the person withdraws consent and no other legal basis supports processing, or the data was processed unlawfully.5gdpr-info.eu. Art. 17 GDPR Right to Erasure (Right to Be Forgotten)
You have one month to respond. Complex requests can be extended by another two months, but you have to notify the individual of the extension within the first month.6European Data Protection Board. How Do I Respond to a Request for Erasure
Refusal is permitted in limited circumstances. The ones that most often intersect with retention are:
- A legal obligation requires you to keep processing the data.
- The data is necessary to establish, exercise, or defend legal claims.
- Processing is necessary for public health purposes.
- Erasure would seriously impair public-interest archiving, scientific, or historical research.
- The data is needed to exercise the right of freedom of expression and information.
When you refuse, you must explain the grounds. If you previously made the data public, you also have to take reasonable steps to notify other controllers processing copies about the erasure request.5gdpr-info.eu. Art. 17 GDPR Right to Erasure (Right to Be Forgotten)
Writing and Enforcing a Retention Policy
Between the accountability principle, the Article 30 documentation obligation, and the transparency duties above, a written retention policy is effectively required.
Map Your Data First
You cannot set retention periods for data you have not catalogued. Article 30 requires controllers to maintain a Record of Processing Activities that includes, among other things, the time limits envisaged for erasure of each category of data.7gdpr-info.eu. Art. 30 GDPR Records of Processing Activities Inventory what you hold, where it came from, what it is used for, and where it lives.
Assign a Period to Each Category
Group data by purpose and legal basis, then apply the factors above: purpose served, legal obligations, litigation risk, and sensitivity. More sensitive categories, such as health or biometric data, generally warrant shorter retention and tighter access controls. Document the reasoning behind each period. “We’ve always kept it” is not reasoning.
Build Retention Into Your Systems
Article 25 requires data protection by design and by default, including measures that enforce minimization at the system level.8gdpr-info.eu. Art. 25 GDPR Data Protection by Design and by Default In practice, that means configuring systems to flag or automatically delete data when its period expires, rather than relying on someone remembering to look. Role-based access should also tighten as data ages toward the end of its lifecycle.
Review Regularly
A retention policy is not a set-and-forget document. Review it at least annually, and whenever new business activities, processing purposes, or laws change the picture. The ICO recommends periodically reviewing what you hold and erasing or anonymizing data you no longer need, noting that the practice also reduces the risk of data becoming inaccurate or out of date.9ICO. Principle (e): Storage Limitation
What to Do When the Period Ends
Two options meet the standard: delete the data, or anonymize it. Leaving it in place is not one of them, and neither is a “deletion” that leaves the data recoverable.
Deletion has to be irreversible. Moving a file to the recycle bin or reformatting a drive leaves data recoverable with widely available tools. For most personal data under the GDPR, that means either overwriting techniques that make recovery infeasible or physical destruction of the media. Paper records need their own destruction process, such as cross-cut shredding, incineration, or pulping. Document what was destroyed, when, and by what method. Where a third party handles destruction, the data processing agreement should cover the obligation and require a certificate of destruction.
Anonymization transforms personal data so that no individual can be identified by any means reasonably likely to be used. Once genuinely anonymized, the data falls outside the GDPR, and you can keep it indefinitely for analytics, research, or historical purposes. The line that trips people up is the one between anonymization and pseudonymization. Pseudonymized data, identified by a code rather than a name, is still personal data under the GDPR because it can be re-linked using separately held information.10European Data Protection Board. What Is the Difference Between Pseudonymised Data and Anonymised Data It stays subject to your retention obligations. True anonymization means no one, including you, can reverse-engineer identities out of the dataset.
What Non-Compliance Costs
Storage limitation is one of the core Article 5 principles, so a violation sits in the GDPR’s higher penalty tier: up to €20 million or 4% of total global annual turnover from the preceding fiscal year, whichever is higher.11gdpr-info.eu. Fines / Penalties – General Data Protection Regulation (GDPR) The lower tier of up to €10 million or 2% of global turnover covers less fundamental failings such as poor record-keeping or missed breach notifications.
Enforcement has followed. In 2022, the French supervisory authority CNIL fined Clearview AI the maximum €20 million for collecting and retaining biometric data without a legal basis, and ordered the deletion of all data on French residents within two months.12European Data Protection Board. The French SA Fines Clearview AI EUR 20 Million Beyond fines, individuals can bring claims for compensation, and the reputational cost of a public enforcement action often outweighs the fine itself. The workable takeaway: set retention periods with real justification, disclose them, enforce them automatically wherever you can, and treat expiration dates with the same seriousness as collection permissions.