Data retention: how long is too long?

Retention follows purpose

The PDPL does not hand you a number. It ties how long you may keep personal data to why you collected it: once the purpose is served, the justification for holding the data ends. Retention, then, is not a storage setting — it is a statement about why each record still exists.

That reframes the question. Instead of asking how long you are allowed to keep something, you ask when the reason for keeping it runs out. A lead that never converted, a form submission already actioned, an analytics record past its useful life — each has a natural expiry.

Windows you can defend

A defensible retention window has three properties: it is written down, it is justified by a purpose or a legal requirement, and it is applied the same way every time. "We delete when we remember" is none of those things.

Different categories deserve different windows. Tax-relevant records may need years; a rejected enquiry may need weeks. The point is that each window is a deliberate decision you can explain, not an accident of whatever the database happened to keep.

Deleting without breaking things

Automated deletion is where good intentions meet real dependencies. Delete a contact that a live workflow still references and you break the workflow. So the schedule has to understand the system it runs inside: what is safe to remove, what must be anonymised instead, and what is genuinely still in use.

Done properly, retention becomes quiet infrastructure. Data ages out on schedule, deletion respects the processes that depend on it, and when someone asks how long you keep personal data, the answer is a policy you can hand over — not a shrug.