Direct answer · GDPR
Retention period and storage limitation
The GDPR itself sets no fixed retention periods. Personal data may not be kept in a form which permits identification of people for longer than is necessary for the purposes for which they are processed (Article 5(1)(e), storage limitation). Longer storage is only allowed for archiving in the public interest, scientific or historical research or statistics, with appropriate safeguards. The organisation therefore determines per purpose how long it needs the data and must be able to demonstrate that it complies (Article 5(2)). It tells data subjects how long the data will be stored, or the criteria used to determine that period (Article 13(2)(a)). Once the data are no longer necessary, they are erased (Article 17(1)(a)), unless the organisation needs them to comply with a legal obligation (Article 17(3)(b)). The Court of Justice held in Digi that data copied into a test database may not stay there longer than is necessary for carrying out the tests and correcting errors.
For you to establish
- For which purpose are the data kept, and does a legal retention obligation apply?
Articles
- Art. 5(1)(e) GDPR Storage limitation: no longer than necessary for the purposes.
- Art. 5(2) GDPR Accountability: being able to demonstrate compliance.
- Art. 13(2)(a) GDPR Informing about the storage period or the criteria for it.
- Art. 17(1)(a) and (3)(b) GDPR Erasure once the data are no longer necessary, except for a legal obligation.
Case law
- Digi (CJEU, C-77/21, ECLI:EU:C:2022:805, 2022-10-20)Operative part 2: storage limitation precludes keeping data in a test database longer than necessary for carrying out tests and correcting errors.
