Data Retention Policy: How Long to Keep Personal Data Under GDPR

The principle

Article 5(1)(e) GDPR, storage limitation, requires personal data to be kept in a form that permits identification of people for no longer than is necessary for the purposes of the processing. Longer storage is allowed only for archiving in the public interest, scientific or historical research or statistics, with appropriate safeguards. Recital 39 adds that the controller should set time limits for erasure or for a periodic review.

Where retention must show up

Document	What it needs	Article
Privacy notice	The retention period, or the criteria used to determine it	13(2)(a), 14(2)(a)
Record of processing activities	Where possible, the envisaged time limits for erasure of each category of data	30(1)(f)
Answers to access requests	Where possible, the retention period or the criteria	15(1)(d)
Erasure requests	Erase without undue delay when the data is no longer necessary, among other grounds	17(1)(a)

How to set the periods

List data categories per processing activity, from your records of processing: customer accounts, invoices, support tickets, marketing contacts, job applicants, employee files, CCTV, logs.
Find legal minimums first. Tax, accounting, employment and sector rules often require keeping certain records for a set number of years. These vary by country; check your national law.
Then the business need. How long do you actually need the data for the purpose, for example handling warranty claims or defending legal claims within the limitation period?
Choose a trigger and a period: "3 years after the account was closed", "6 months after the recruitment ended", not just "3 years".
Decide what happens at the end: deletion, anonymisation, or a review if a legal hold applies.

A retention schedule

Data category	Trigger	Period	Basis	End action
Invoices and accounting records	End of financial year	As national accounting or tax law requires	Legal obligation	Delete
Customer account data	Account closed	Your choice, justified by business need	Contract, then legitimate interest	Delete or anonymise
Marketing contacts	Last interaction or consent withdrawn	Your choice; stop immediately on objection	Consent or legitimate interest	Delete, keep a suppression record
Job applications (unsuccessful)	Recruitment closed	Short, justified period unless the applicant agrees to longer	Steps prior to a contract	Delete
Security logs	Log created	Long enough to detect and investigate incidents	Legitimate interest, legal obligation	Delete

The periods in this example are placeholders: set yours from your national law and documented business need.

Keep a suppression list: after someone objects to marketing, you may keep the minimum needed to make sure you do not contact them again; deleting everything can lead you to email them again.

Actually deleting

Automate where possible: retention settings in your CRM, mailbox, ticketing and storage tools.
Include backups: data can live on in backups until they expire; document that and make sure restored backups do not bring deleted data back into use.
Anonymisation must be real: if people can still be identified, it is still personal data.
Run a periodic review, at least yearly, and record it.
Remember processors: your data processing agreements should require deletion or return at the end of the service.

Document it once, use it everywhere. The GDPR Records of Processing (RoPA) Kit includes RoPA templates with retention fields, a data inventory workbook and a completion guide.

Sources

Regulation (EU) 2016/679 (GDPR), Articles 5, 13, 14, 15, 17 and 30, recital 39, EUR-Lex