How long can data be stored under GDPR?

The GDPR does not set one universal retention period. Its storage limitation principle requires identifiable personal data to be kept only for as long as necessary for its processing purposes.

Organisations must:

• Set and justify retention periods based on the purpose, applicable legal duties and necessary legal-claim requirements.

• Explain the retention period, or the criteria used to determine it, in their privacy information.

• Review stored data and delete it or convert it into anonymised data when identification is no longer necessary.

For example, national tax law may require invoices to be retained after a customer closes an account. This does not justify retaining every other customer record indefinitely.

Longer storage can be permitted solely for public-interest archiving, scientific or historical research, or statistical purposes, subject to the GDPR’s conditions and appropriate safeguards.