Storage limitation

What it means

Storage limitation is the GDPR principle that personal data are kept in a form permitting identification only for as long as necessary for the purpose of processing. After that they must be deleted or anonymised.

The principle does not prohibit long retention where the law requires it. Accounting documents must be kept for ten years, payroll records and data needed for pension insurance even longer, and tax documents for the period in which tax can be assessed. These obligations take precedence over a request for deletion.

The real problem is usually the opposite: a company keeping data without reason, such as CVs of unsuccessful candidates years after recruitment, old backups or contacts from long-finished jobs. Each such item is an unnecessary risk in a data breach.

How it works in practice

A company should have a retention schedule that sets the period, reason and method of deletion for each type of data. Linking it with records management and the rules on document retention, which already set periods for accounting and HR documents, helps.

At the end of the period, data are deleted or anonymised. For paper documents this means shredding; for electronic ones, deletion from systems including copies. Backups are handled by overwriting them at the end of their life and ensuring deleted data are not restored if a backup is used.

When a data subject requests erasure, the company assesses whether it must keep some data by law. It deletes data that are no longer needed and explains for the rest why and until when they are kept, for example because of the retention period for accounting documents.

What to watch out for

Vague periods such as we keep data as long as necessary are not enough. Supervisory authorities expect a specific period or the criteria used to determine it, and privacy notices must tell data subjects how long their data will be kept.

Deleting data in one system is not enough if they remain in emails, shared folders or with processors. When planning deletion, consider every place where data are held, and require processors to confirm deletion when the contract ends.