Data Retention: How Long May You Keep Personal Data?

Why is this important?

The GDPR is clear: you may not keep personal data longer than necessary to achieve the purpose for which you collected it. Yet most businesses keep data much longer than necessary, simply because nobody ever thinks about it.

The risk? During an inspection by the supervisory authority, or when a customer submits a deletion request, you must be able to explain why you still hold certain data. “We never thought about it” is not a valid answer.

Common retention periods

Below is an overview of common retention periods. Note: these are guidelines - always check the specific legislation that applies to your situation.

Data type	Legal basis	Retention period
Accounting documents (invoices, payments)	Tax legislation	7 years
Personnel files	Employment law	5 years after end of employment
Application data (unsuccessful candidates)	Legitimate interest	For a limited period after the recruitment process, based on a documented retention period. Longer retention for future vacancies requires a separate talent-pool purpose and legal basis.
Customer data (active relationship)	Contract performance	Duration of relationship
Customer data (after termination)	Legitimate interest	Max. 2 years
CCTV footage	Legitimate interest	Max. 1 month (unless incident)
Website analytics (IP addresses)	Consent / legitimate interest	Max. 26 months
Contact form submissions	Legitimate interest	Max. 2 years after last contact
Newsletter subscribers	Consent	Until consent is withdrawn

The recruitment row is the one employers most often get wrong, because the GDPR sets no fixed period for candidate data and the numbers circulating online come from national guidance rather than the Regulation. How long can you keep a candidate’s CV? works through how to set that period, and do you need consent to keep a candidate’s CV? covers the separate talent-pool basis.

How to create a retention policy

Step 1: Inventory your processing activities

You cannot set retention periods if you don’t know what data you process. Start with your processing register - all processing activities are listed there.

Step 2: Determine the period per activity

Ask yourself per processing activity:

• Is there a legal retention obligation? If so, that applies
• If not, how long do I really need the data for the purpose?
• Is there an industry standard I can follow?

Step 3: Document your choices

Record per processing activity:

• Which retention period you apply
• Why (legal basis or justification)
• What happens when it expires (deletion, anonymisation)

Step 4: Implement and monitor

• Set reminders for checking and deleting expired data
• Configure automatic deletion where possible
• Check at least annually whether your policy is still current

Common mistakes

• Keeping everything “forever” because it’s easier. This is a GDPR violation
• Not distinguishing between active and inactive customers
• Forgetting backups: if you delete data but it’s still in a backup, you’re not done
• No policy on paper: if you haven’t documented it, it doesn’t exist for the supervisory authority