How long should data be kept?

To remember

Data can be kept for as long as necessary to meet the purpose of processing or to comply with legal obligations. The data controller must determine a fixed retention period or an objective criteria for determining this period, such as the duration of a contractual relationship with a customer.

Once the purpose of processing is met, data must be deleted, anonymized or archived (under certain criteria and following specific rules).

Anonymization

Anonymization involves altering data so that it can no longer identify individuals and can be kept for statistical purposes.

Archiving

Data archiving involves three phases:

• the active database, which is used for processing objectives and accessible to operational departments
• intermediate archiving for cases where it may be justified
• and long-term archiving where data is stored for legal, historical, or research purposes

The retention period for archived data should be determined based on the purpose of the archiving and compliance with legal requirements.