The General Data Protection Regulation (GDPR) sets out strict rules for the storage of personal data, requiring that such data be kept in a form that identifies people for no longer than is necessary for the purposes for which it is processed. Longer storage is allowed only for archiving in the public interest, scientific or historical research, or statistical purposes, with appropriate safeguards. The GDPR recognizes that personal data can be stored for varying periods of time, depending on the specific circumstances of each case.

Determining the Appropriate Retention Period

In determining the appropriate retention period for personal data, organizations must consider the purpose for which the data was collected and the risks associated with continued storage of the data. For example, if the data was collected for the purpose of providing a service, it may need to be stored for the duration of the service. In other cases, where the data was collected for legal or regulatory purposes, it may need to be stored for a longer period of time.

The Right to Erasure

Under the GDPR, individuals have the right to request the erasure of their personal data, also known as the “right to be forgotten”. The right to erasure applies in specific situations, for example where the personal data is no longer necessary in relation to the purposes for which it was collected, or where the individual has withdrawn their consent and there is no other legal ground for the processing. Organizations must respond to erasure requests without undue delay, and within one month of receiving the request at the latest. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; the individual must be told about the extension, and the reasons for the delay, within the first month.

Conclusion

In conclusion, the GDPR sets strict limits on the storage of personal data, requiring organizations to only keep such data for as long as is necessary for the purposes for which it is processed, apart from limited exceptions such as archiving in the public interest, scientific or historical research, or statistical purposes. Organizations must carefully consider the appropriate retention period for each case, and be prepared to erase personal data at the request of individuals where the right to erasure applies.