Privacy

Storage Limitation

Personal data should be kept only for as long as necessary for its stated purpose.

Storage limitation (also called data retention limitation) requires that personal data be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed.

In Practice

  • Define and document retention periods for each category of data
  • Implement automated deletion or anonymization when the retention period expires
  • Regularly review stored data and purge what is no longer needed
  • Clearly communicate your retention periods in your privacy policy

GDPR Article 5(1)(e). See also data retention.

Related Terms

Data MinimizationPrivacy

The principle that only the minimum amount of personal data necessary should be collected and processed.

Purpose LimitationPrivacy

Personal data must be collected for specified, explicit purposes and not further processed in an incompatible way.

Data RetentionPrivacy

The policies and practices governing how long personal data is stored before being deleted or anonymized.

Privacy PolicyCompliance

A public document that explains how an organisation collects, uses, stores, and shares personal data.

Standard Contractual ClausesSub-Processor