How Long May You Keep Personal Data?

The legal framework

Article 5(1)(e) GDPR provides that personal data must be kept in a form which permits identification of individuals for no longer than is necessary for the purposes of the processing. The GDPR sets no general retention period. The period follows from the purpose: while the purpose lasts and a lawful basis exists, you may keep the data; when it ends, you must delete or anonymise the data.

Several other provisions build on this principle:

• Article 13(2)(a) and 14(2)(a) require you to tell individuals the retention period or the criteria used to determine it.
• Article 30(1)(f) asks for the envisaged time limits for erasure in the record of processing activities.
• Article 17(1)(a) gives individuals a right to erasure when data is no longer necessary for its purpose, subject to the exceptions in Article 17(3).
• Article 25 (data protection by design and by default) means deletion should be built into systems.

Where the period comes from

Retention periods come from four sources.

First, the purpose itself. A newsletter list is kept while the subscription lasts. Job applications are kept for the duration of the selection and, with the applicant's consent or a documented legitimate interest, for a limited further period. For applicant files the GDPR gives no fixed period, and national law often does not either, so you must choose and justify one.

Second, legal obligations that require retention. National accounting and tax laws prescribe minimum periods for accounting records and supporting documents, and these differ per member state. EU anti-money-laundering rules require obliged entities to keep identification and transaction data for five years after the end of the business relationship. Sector rules (health care, employment, social security) set others. Check the current national text for each category and each country where you operate.

Third, legal claims. Data needed to establish, exercise or defend a claim may be kept for as long as the claim can be brought, which depends on the applicable limitation period. This is a reason to keep a defined set of records, not a reason to keep everything.

Fourth, specific authorisations such as an individual's consent, which ends on withdrawal.

Anonymisation and archiving

Truly anonymous data falls outside the GDPR, but anonymisation must be irreversible in practice. Pseudonymised data remains personal data. Archiving for longer periods is possible for archiving in the public interest, scientific or historical research and statistical purposes under Article 89, with safeguards.

In practice

An HR services company keeps the files of former clients' employees in its payroll system. It has no retention schedule, so files from fifteen years ago are still there. When it prepares its record of processing, it sorts the data into categories: payroll data needed for legal retention, contracts and correspondence needed for possible disputes, and recruitment files. For each, it records a period and the reason. Payroll records are kept for the legally required period after the end of the engagement, and then deleted. Recruitment files are deleted a defined number of months after the selection. A yearly deletion run is planned and logged.

When an employee of a former client later asks for erasure, the company can answer precisely: the data kept for legal obligations stays, with a reference to the law, and the rest is deleted.

Making deletion happen

A schedule on paper does nothing unless systems apply it. Identify who owns each category, where the data lives (including backups, exports and email), and how deletion is performed and verified. Deletion in backups can be handled by letting them expire on a defined cycle, as long as restored data is re-deleted and the data in backups is not used. Processors must delete or return data at the end of the services, which belongs in your processing agreement.

Our register function records the retention period and the reason for each activity, and request handling uses the same information when an erasure request arrives.

Frequently asked questions

Is there a standard retention period under the GDPR?

No. You set it by purpose, within the limits of other laws.

Can we keep everything "just in case" of a dispute?

No. Keep records that are realistically needed for a possible claim, for as long as the claim can be brought, and delete the rest.

Do we have to delete data in backups immediately?

Not immediately, but you need a defined backup cycle and a process to prevent deleted data from returning after a restore.

Is anonymisation an alternative to deletion?

Yes, if it is irreversible in practice. Removing a name while keeping a unique identifier is pseudonymisation, and the data stays personal.

How this connects

A retention schedule belongs in your record of processing, as described in Records of Processing Activities, and is part of DPO as a Service. The retention and deletion duties of suppliers are addressed in data processing agreements.