Key points
- The GDPR strictly governs data retention periods, requiring the controller to define, justify and document them according to the purpose.
- Data must not be kept longer than necessary for its original purpose, under the storage limitation principle.
- HR management data is kept for the duration of the contract, then archived according to statutory periods, for example five years for copies of payslips.
- Client files follow the business relationship and then legal obligations (ten years for accounting records); prospecting data, three years after the last contact initiated by the person.
- A healthcare institution’s medical record is kept for twenty years after the last stay or consultation, and CCTV footage of a place open to the public for one month at most.
- The controller must ensure deletion when the period expires and demonstrate compliance through reliable, up-to-date traceability.
The management and retention of personal data is now a major issue for every organisation. The General Data Protection Regulation (GDPR) strictly governs the retention period of collected data, requiring the controller to define, justify and document each retention period according to the purpose of the processing. Any company, public body or association handling personal information must therefore meet the regulatory requirements to ensure GDPR compliance, limit legal risks and preserve the trust of the data subjects.
What is a data retention period under the GDPR?
The GDPR requires that personal data not be kept longer than necessary to achieve its original objective, known as the purpose of the processing. This means that each type of information must be linked to a clear and justified retention period, with no possibility of keeping files indefinitely as a precaution.
This obligation stems from the storage limitation principle. Setting the right data retention period therefore involves analysing the activity concerned, the legal basis relied on and any legal obligations that apply. In addition, failure to comply with these rules exposes the controller to sanctions and to a loss of credibility with users.
How long can you keep personal data? Retention periods by type of data
Defining an effective archiving policy relies on a rigorous methodology that takes several essential factors into account. Classifying the different categories of data, listing the applicable legal grounds and then setting an explicit rule for each file ensure transparency and legal certainty. If you want to go further in analysing the legal requirements and obtain tailored advice, it may be useful to consult a GDPR lawyer.
Some periods are set by specific legislation, such as the French Labour Code or the French Consumer Code, while others depend on the organisation’s own assessment linked to the purpose of the processing. The controller must also plan for intermediate or permanent archiving periods once the information is no longer in active use.
The main categories of data and their usual retention periods
Factors for setting the retention period
The categories of data processed can vary considerably depending on the activity: employee, client, prospect, partner or supplier files, CCTV, health data, etc. In each case, a general rule emerges:
- HR management data: kept for the entire duration of the employment contract, then archived according to the applicable statutory periods, for example five years for copies of payslips (Article L. 3243-4 of the French Labour Code (Code du travail) (in French)). Limitation periods vary depending on the claim: two years for claims relating to the performance of the contract, twelve months for its termination (Article L. 1471-1 of the Labour Code (in French)).
- Client and order files: duration of the business relationship, then archiving according to legal obligations, for example ten years for accounting documents and supporting records (Article L. 123-22 of the French Commercial Code (Code de commerce) (in French)).
- Data from commercial prospecting: three years at most from collection or from the last contact initiated by the data subject, according to the reference framework (référentiel) of 23 September 2021 issued by the CNIL (French data protection authority).
- Health data: the medical record kept by a healthcare institution is retained for twenty years from the last stay or last outpatient consultation, with an extension in certain cases (Article R. 1112-7 of the French Public Health Code (Code de la santé publique) (in French)).
- CCTV data: for video surveillance of a place open to the public, footage must be destroyed within the period set by the authorisation, which cannot exceed one month, except in the case of a criminal investigation or judicial inquiry (Article L. 252-5 of the French Internal Security Code (Code de la sécurité intérieure) (in French)).
To decide on the optimal retention period, you should examine:
- the legal obligation applicable to certain sensitive categories,
- the exact purpose stated in the record of processing activities,
- the type of relationship with the person (employee, client, prospect),
- the risks in the event of loss, disclosure or alteration,
- whether or not there are potential claims relating to the controller’s liability.
The controller’s practical obligations on data retention
Beyond setting appropriate periods, GDPR accountability requires concrete measures to ensure that data is deleted once the period expires. Documentary evidence plays a key role here: every organisation must be able to demonstrate its compliance through reliable, up-to-date traceability. To apply the rules correctly and check whether your practices are adequate, it is worth finding out how to recognise a GDPR-compliant website.
The lack of an appropriate erasure mechanism can lead to inspections, or even administrative sanctions. Organising archiving and destruction therefore requires rigour, forward planning and the involvement of all the departments concerned.
Defining and documenting the retention period
Organising the archiving and deletion of data
The first step is to record each retention period in the record of processing activities. Required by Article 30 of the GDPR, this record applies to most organisations: the exemption for organisations with fewer than 250 employees does not apply to processing that is not occasional, that is likely to result in a risk or that involves sensitive data. For each activity, it sets out:
- the nature of the data concerned,
- the purpose of the processing,
- the legal basis relied on,
- the retention period chosen,
- the secure storage and archiving arrangements.
Justifying the period chosen also makes it possible to answer any questions from the supervisory authority or the data subjects.
Organising the deletion of data then requires robust technical and human procedures. Scheduled automatic alerts, regular audits and periodic clean-up campaigns help to remove unnecessary or obsolete information effectively.
In some cases, particularly in the event of a dispute, retention may be extended temporarily. Any exception must nevertheless be precisely recorded.
Summary table: examples of GDPR data retention periods by type of data
A concise overview of the main retention periods makes correct application within the company easier and makes everyone responsible for GDPR compliance accountable.
| Type of data | Example of purpose | Legal basis | Retention period |
|---|---|---|---|
| Employee HR data | Administrative management | Legal obligation, Contract | During the contract + 5 years |
| Client file | Invoicing and accounting | Legal obligation | 10 years (accounting records) |
| Prospect data | Marketing campaign | Legitimate interest, Consent | 3 years from last contact |
| CCTV | Security | Legitimate interest | 1 month maximum (place open to the public) |
| Health data | Medical follow-up | Legal obligation | 20 years after the last stay (medical record) |
Each organisation must adapt this table to the specific features of its processing, consulting a lawyer if necessary to validate each line.
Remember to communicate these periods to your teams regularly to avoid any confusion or oversight, particularly in the event of an audit or external inspection.
Erasure procedures and archive management
Deleting data when the period expires is essential to ensure GDPR compliance. This sometimes involves managing so-called “intermediate” archives, in which certain information continues to be kept with restricted access before being erased completely.
Legally, the organisation must provide clear conditions for automatic or manual erasure, together with a reliable and traceable internal protocol. This requires the involvement of the IT department, as well as sufficient training for the staff responsible for collecting and managing personal files.
Do not overlook the importance of backup solutions: they must follow the same purge rules to avoid untimely and uncontrolled restorations.
Handling these processes in-house, or delegating them by contract to a qualified service provider, is an integral part of GDPR compliance and directly engages the controller’s liability.
FAQ: GDPR data retention periods and obligations
What criteria determine how long personal data can be kept?
Several elements must be combined: the purpose of the processing defined at the time of collection, the legal basis justifying the operation (contract, legitimate interest, legal obligation, etc.), and sector recommendations or requirements laid down by regulation. A comparison table can help visualise all the parameters for each type of information.
| Criterion | Description |
|---|---|
| Purpose of the processing | Specific objective assigned to the data |
| Legal basis | Legal ground authorising collection and processing |
| Legal obligation | Period set by statute or by sector regulation |
| Official recommendations | Opinions of authorities such as the CNIL |
What are the essential steps when deleting data at the end of the retention period?
When the retention period expires, a strict procedure must be followed, including:
- Checking eligibility for deletion using the tracking tool or the record.
- Secure erasure of physical and digital media (permanent deletion or irreversible anonymisation).
- Documenting each operation to provide the traceability required for GDPR compliance.
Human intervention must complement automated systems to prevent accidental errors or omissions.
Are there sanctions for failing to comply with GDPR retention periods?
Yes, failing to delete personal data at the end of its legal retention period is a clear breach of GDPR compliance. Depending on the seriousness of the breach, this may lead to:
- An administrative formal notice to remedy the situation as soon as possible.
- Financial penalties of up to €20 million or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher (Article 83(5) of the GDPR).
- Significant reputational damage in the event of public disclosure.
Adopting a clear and appropriate policy avoids these complications, which can have serious consequences for the organisation.
How do you choose between intermediate archiving and immediate deletion of data?
Intermediate archiving applies when a legal or contractual obligation requires certain documents to be kept, with no day-to-day use but with a need for restricted access (for example, in the event of a potential dispute). As soon as there is no longer any justification, data must be deleted without delay. In-depth dialogue with the business teams concerned helps to make the right call.
It is still advisable to map all the situations that may involve exceptions so that you can respond quickly, particularly in the event of a GDPR inspection.
