The principle of storage limitation requires personal data to be kept in a form which permits identification for no longer than is necessary for the purpose of the processing.
How long data may be stored
There is no single time limit. What matters is the purpose of the processing and statutory retention obligations, for example under commercial and tax law. Once the period has expired, the data must be erased or anonymised.
Where a fixed period cannot yet be determined, criteria for determining it and regular reviews must be provided for.
Transparency
The retention period, or the criteria used to determine it, must be stated in the privacy information. The envisaged time limits for erasure must be documented in the record of processing activities.
Legal provisions
- Art. 5(1)(e) GDPR
- Principle of storage limitation.
- Art. 13(2)(a) GDPR
- Information about the retention period.
- Recital 39 GDPR
- Time limits for erasure and periodic review.
Related terms.
Deletion concept A deletion concept sets out in a binding manner which personal data is deleted when, how and by whom. Art. 5(1)(e) GDPR 
Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR
All terms from A to Z Right to erasure / erasure of personal data The right to erasure obliges controllers to erase personal data without undue delay where one of the statutory grounds for erasure applies. Art. 17 GDPR Data minimisation Data minimisation is the principle that only as much personal data may be processed as is necessary for the purpose in question. Art. 5(1)(c) GDPR 