Data Retention
Policies governing how long personal data is stored before being deleted or anonymized.
Data retention refers to the policies and practices that govern how long an organization keeps personal data. Under GDPR's storage limitation principle (Article 5(1)(e)), personal data must be kept for no longer than necessary for the purposes for which it was collected. Organizations should: define retention periods for each category of data, document the legal basis for retention, implement automated deletion or anonymization at the end of retention periods, and regularly review and update retention schedules. Different regulations may impose minimum retention requirements (e.g., tax records, employment records), while privacy laws generally require minimizing retention. A clear retention policy reduces risk, storage costs, and the scope of potential data breaches.