--- title: "How Long May You Keep Personal Data? | Pitch" description: "The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice." url: https://www.pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Privacy & Data Protection](https://www.pitch.law/academy/topics/privacy) # How Long May You Keep Personal Data? The storage limitation principle in Article 5(1)(e) GDPR, how to set retention periods and how to delete in practice. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework Article 5(1)(e) GDPR provides that personal data must be kept in a form which permits identification of individuals for no longer than is necessary for the purposes of the processing. The GDPR sets no general retention period. The period follows from the purpose: while the purpose lasts and a lawful basis exists, you may keep the data; when it ends, you must delete or anonymise the data. Several other provisions build on this principle: - Article 13(2)(a) and 14(2)(a) require you to tell individuals the retention period or the criteria used to determine it. - Article 30(1)(f) asks for the envisaged time limits for erasure in the record of processing activities. - Article 17(1)(a) gives individuals a right to erasure when data is no longer necessary for its purpose, subject to the exceptions in Article 17(3). - Article 25 (data protection by design and by default) means deletion should be built into systems. ### Where the period comes from Retention periods come from four sources. First, the purpose itself. A newsletter list is kept while the subscription lasts. Job applications are kept for the duration of the selection and, with the applicant's consent or a documented legitimate interest, for a limited further period. For applicant files the GDPR gives no fixed period, and national law often does not either, so you must choose and justify one. Second, legal obligations that require retention. National accounting and tax laws prescribe minimum periods for accounting records and supporting documents, and these differ per member state. EU anti-money-laundering rules require obliged entities to keep identification and transaction data for five years after the end of the business relationship. Sector rules (health care, employment, social security) set others. Check the current national text for each category and each country where you operate. Third, legal claims. Data needed to establish, exercise or defend a claim may be kept for as long as the claim can be brought, which depends on the applicable limitation period. This is a reason to keep a defined set of records, not a reason to keep everything. Fourth, specific authorisations such as an individual's consent, which ends on withdrawal. ### Anonymisation and archiving Truly anonymous data falls outside the GDPR, but anonymisation must be irreversible in practice. Pseudonymised data remains personal data. Archiving for longer periods is possible for archiving in the public interest, scientific or historical research and statistical purposes under Article 89, with safeguards. ## In practice An HR services company keeps the files of former clients' employees in its payroll system. It has no retention schedule, so files from fifteen years ago are still there. When it prepares its record of processing, it sorts the data into categories: payroll data needed for legal retention, contracts and correspondence needed for possible disputes, and recruitment files. For each, it records a period and the reason. Payroll records are kept for the legally required period after the end of the engagement, and then deleted. Recruitment files are deleted a defined number of months after the selection. A yearly deletion run is planned and logged. When an employee of a former client later asks for erasure, the company can answer precisely: the data kept for legal obligations stays, with a reference to the law, and the rest is deleted. ### Making deletion happen A schedule on paper does nothing unless systems apply it. Identify who owns each category, where the data lives (including backups, exports and email), and how deletion is performed and verified. Deletion in backups can be handled by letting them expire on a defined cycle, as long as restored data is re-deleted and the data in backups is not used. Processors must delete or return data at the end of the services, which belongs in your [processing agreement](https://www.pitch.law/solutions/data-processing-agreements). [Our register function](https://www.pitch.law/technologies/privacy-register) records the retention period and the reason for each activity, and [request handling](https://www.pitch.law/technologies/dsar-handling) uses the same information when an erasure request arrives. ## Frequently asked questions ### Is there a standard retention period under the GDPR? No. You set it by purpose, within the limits of other laws. ### Can we keep everything "just in case" of a dispute? No. Keep records that are realistically needed for a possible claim, for as long as the claim can be brought, and delete the rest. ### Do we have to delete data in backups immediately? Not immediately, but you need a defined backup cycle and a process to prevent deleted data from returning after a restore. ### Is anonymisation an alternative to deletion? Yes, if it is irreversible in practice. Removing a name while keeping a unique identifier is pseudonymisation, and the data stays personal. ## How this connects A retention schedule belongs in your record of processing, as described in [Records of Processing Activities](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know), and is part of [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service). The retention and deletion duties of suppliers are addressed in [data processing agreements](https://www.pitch.law/solutions/data-processing-agreements). ## In short - Storage limitation under Article 5(1)(e) - Where retention periods come from - Making deletion happen in practice ## Related solutions - [Solutions](https://www.pitch.law/solutions/dpo-as-a-service) ### [DPO as a Service](https://www.pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://www.pitch.law/solutions/dpo-as-a-service) - [Solutions](https://www.pitch.law/solutions/data-processing-agreements) ### [Data Processing Agreements](https://www.pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://www.pitch.law/solutions/data-processing-agreements) ## Technology we use - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) - [Technology](https://www.pitch.law/technologies/dsar-handling) ### [Data Subject Requests](https://www.pitch.law/technologies/dsar-handling) [Requests from individuals are logged in the client portal, tracked against the deadline and fulfilled with a data export and, for erasure, a cascade across linked records.](https://www.pitch.law/technologies/dsar-handling) - [Technology](https://www.pitch.law/technologies/contract-studio) ### [Document Studio](https://www.pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://www.pitch.law/technologies/contract-studio) ## More in Privacy & Data Protection - ### [Cookies and Consent](https://www.pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://www.pitch.law/academy/cookie-compliance-and-consent-management) - ### [Data Breaches: the 72-Hour Rule](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) [When a personal data breach must be notified to the data protection authority and to individuals, how the 72 hours are counted and what to document.](https://www.pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [Data Subject Access Requests](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [How the right of access works under Article 15 GDPR, how to handle the deadline, what you may refuse and what a good response contains.](https://www.pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [Records of Processing Activities (RoPA)](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) [What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful.](https://www.pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know) - ### [International Data Transfers](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://www.pitch.law/academy/international-data-transfers-post-schrems-ii) - ### [Website Technology Audits and the GDPR](https://www.pitch.law/academy/website-technology-audits-and-gdpr) [What a website technology audit examines, why privacy notices and actual data flows drift apart, and which legal duties it checks.](https://www.pitch.law/academy/website-technology-audits-and-gdpr) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)