GDPR Q16

How long can I keep personal data?

Q16. How long can I keep personal data?

Category: Retention

You should only keep personal data for as long as it is needed. Once the purpose is complete, delete or anonymise the information.

In simple terms

Set retention periods based on purpose and legal obligations.
Review schedules regularly and dispose of data securely.
Document decisions so you can show accountability.

Planning retention

Start with your purposes and map legal or industry requirements. Some records, like financial data, have statutory retention periods. Others should be kept only as long as they add value.

Consult regulations such as tax or health and safety rules.
Involve business owners to agree realistic timelines.
Include email, documents, and backups in the schedule.

Carrying out deletion

Set up processes to delete, destroy, or anonymise data when retention periods expire. Use secure methods for paper and digital records.

Automate deletion where systems allow.
Log what was deleted and when to evidence compliance.
If you need to keep data longer for legal claims, review the decision regularly.

Practical steps to take

Create a retention schedule covering all systems and formats.
Tag records with review or expiry dates.
Train staff to follow secure disposal procedures.
Carry out periodic audits to confirm the schedule is followed.
Update the schedule when laws or business needs change.

Real-life examples

HR records

An employer keeps employee files for six years after employment ends to meet limitation periods, then securely deletes them.

Customer accounts

An online store deletes inactive customer accounts after two years unless there is an outstanding order or legal reason to keep them.

Helpful reminders

Avoid blanket ‘keep forever’ policies—justify every timeframe.
Apply retention rules to backups and archives as well as live systems.
Document exceptions, including who approved them and why.

Key takeaway

Retention schedules show respect for people’s data—only keep what you need and dispose of the rest safely.

Article references

Article 5(1)(e) – Storage limitation