Article 5(1)(e) GDPR requires organisations to limit how long they keep personal data in identifiable form. The duration must be justified by the purposes of processing. The provision also contains a qualified rule allowing longer storage for public-interest archiving, scientific or historical research, or statistical purposes. Neither rule supplies a universal number of months or years.
The official GDPR on EUR-Lex is the legal source. This guide explains how to read its storage limitation provision alongside the rules on accountability, transparency, records and erasure. It does not present a national retention table as if it applied across Europe. A period that is correct for one country’s accounting records may be wrong for a different record, purpose or jurisdiction.
Reading Article 5(1)(e) in context
The phrase “no longer than is necessary” connects retention to the purpose for which personal data are processed. It is not enough to say that keeping information could be convenient. The controller needs a reason why identifiable information remains necessary, including where a separate legal obligation requires particular records to be retained.
The reference to a form permitting identification matters too. Moving an account into an archive does not make its contents anonymous. Replacing a name with a customer number usually does not end the GDPR’s application where the person can still be identified. Restrictions on access are valuable safeguards, but they answer a different question from whether continued storage is justified.
The second part of Article 5(1)(e) permits longer storage insofar as the data will be processed solely for the listed archiving, research or statistical purposes. It expressly links that treatment to Article 89(1) and appropriate technical and organisational safeguards. A folder called “research archive” cannot by itself satisfy those conditions, particularly if staff still use the information for ordinary customer targeting.
Article 5(2) then makes the controller responsible for compliance and for demonstrating it. This is why a retention decision should be explainable. A schedule, a documented exception and evidence that the system follows the decision can support accountability. None independently proves that an unnecessarily long period is lawful.
The recitals explain the purpose of the rule
Recital 39 connects limited storage with establishing time limits for erasure or periodic review. This supports a deliberate process rather than passive accumulation. A review date is useful where circumstances must be reassessed, but conducting the review without acting on its outcome does not justify continued retention.
Recital 26 explains identification by reference to means reasonably likely to be used by the controller or another person, taking account of relevant objective factors. The inquiry is contextual. It does not reduce to removing one visible identifier, and it does not require pretending that every theoretical attack has equal practical significance.
Recitals 65 and 156 help place erasure and the research safeguards in their wider setting. Recitals aid interpretation; they should be read with the operative articles. For example, a general statement about research does not remove the need to check the conditions in Articles 17 and 89 when responding to an erasure request.
Identify the purpose before choosing a duration
Start with the question the record must answer. A delivery address helps send an order to the right place. A transaction record may support required accounting. Detailed customer service notes may be needed to resolve a particular complaint. These are related activities, but their data requirements and retention triggers can differ.
A single customer profile can therefore contain information with different end dates. Retaining an invoice because a legal obligation requires it does not automatically justify keeping location histories, recordings or unrelated support attachments for the same period. The data minimisation principle continues to apply to the retained information.
A sensible rule identifies the category, the purpose, the starting event, the duration or review criterion, and the eventual action. A period measured from the end of a contract differs from one measured from the end of a financial year. Confusing the two can produce systematic errors even when the number of years is correct.
Also distinguish a mandatory minimum from a legal maximum or a recommended benchmark. A law requiring preservation of specified documents is different from guidance suggesting a normally appropriate duration. Record which source applies and why. Where several requirements overlap, determine their scope rather than applying the longest number to everything.
There is no GDPR retention table for every organisation
The GDPR itself does not prescribe a standard period for rejected applications, customer accounts, security logs or camera recordings. The Irish Data Protection Commission’s retention guidance explains the need to consider the processing purpose and applicable statutory obligations. Its general explanation should not be mistaken for a complete statement of every country’s sectoral laws.
For a multinational organisation, a central schedule can still be useful. It should identify local requirements and explain when a particular branch or record is covered. Copying a national authority’s example into a global policy without its factual and legal context can turn a useful reference into an incorrect rule.
Where no fixed statutory period applies, the controller must assess necessity rather than invent a supposed legal deadline. Relevant evidence might include how long a service issue can reasonably remain unresolved, what a continuing relationship requires and whether a narrower record can serve the same purpose. Review that assessment when the service or use of the information changes.
Separate working records from restricted retention
An organisation may finish the immediate service yet need to retain certain information for a different lawful purpose. That change should affect access and permitted use. A record preserved for accounting or an identified dispute should not remain freely available to staff building new marketing segments.
For example, consider a closed subscription account. The organisation might no longer need the user’s preferences to deliver the service, while a particular payment record remains subject to a legal obligation. It should determine what to remove, what to preserve and who still needs access. An indiscriminate “inactive” label does not resolve those decisions.
Retention for establishing, exercising or defending legal claims requires an actual assessment of the relevant records and circumstances. The possibility that someone might someday complain is not a complete justification for indefinite storage. A documented hold should identify the matter, covered information, responsible person and conditions for reassessment or release.
When the hold ends, the organisation should return to the applicable rule. Automatically restarting the original retention period can prolong storage without a reason. Equally, deleting material subject to a valid preservation obligation because a routine job reaches its date can undermine another legal duty. The process must reconcile both requirements.
Longer storage for research, statistics and public-interest archives
Article 89(1) requires safeguards for the rights and freedoms of individuals, including technical and organisational measures that ensure data minimisation. Pseudonymisation may be one measure where the purpose can be fulfilled that way. If further processing can fulfil the purpose without identifying people, the article requires it to be carried out in that manner.
Public-interest archiving is more specific than keeping an ordinary business archive. Research and statistical purposes also need a real description, with appropriate governance and a lawful basis. Article 5(1)(e) does not create a general permission to collect sensitive records or override the separate requirements for special categories of personal data.
The condition concerning sole use for the listed purposes must remain meaningful. If an organisation maintains an identifiable historical dataset for research but also uses the same records for unrelated commercial decisions, it must separately examine that use. It cannot extend an exceptional retention rationale to the second activity merely because both use one database.
Nor does Article 89 automatically extinguish individual rights. Its derogations depend on the relevant Union or Member State law and their stated conditions. Article 17(3)(d) has its own qualified erasure exception where erasure would be likely to render the specified purposes impossible or seriously impair them. A refusal needs the applicable analysis, not simply the word “research”.
Anonymisation is a substantive outcome
Personal data that have genuinely become anonymous fall outside the GDPR’s personal-data rules. Whether that result has been achieved depends on the data and circumstances. Replacing names, deleting a lookup table or aggregating records may help, but none is a universal guarantee.
A small aggregate can still reveal a person, and a detailed event history can remain recognisable through external information. The assessment should consider what information remains, who may reasonably obtain it and how the result could be linked to identifiable people. Pseudonymised data remain personal data where the relevant identification test is met.
The EDPB’s final Guidelines 4/2019 on data protection by design and by default discuss effective deletion, anonymisation and retention controls. They also emphasise contextual assessment and review. A technique that was adequate for one release may need reconsideration when new data are added or access arrangements change.
Processing information to anonymise it is itself processing of personal data until the outcome is achieved. The controller must therefore consider its legal basis, security and scope during that operation. Anonymisation should serve a defined purpose; it is not an excuse to collect unnecessary identifiable information first.
Backups, logs and exported copies still need decisions
Storage limitation applies beyond the primary application. Backups, logs, exports, shared folders and email attachments may contain personal data after the visible record disappears. The EDPB guidance calls for determining what data and storage duration are necessary for backups and logs. It does not supply a universal thirty-, sixty- or ninety-day safe harbour.
A backup supports recovery, which can require a different design from an operational database. The controller should assess recovery needs, access restrictions, replacement cycles and the treatment of records already erased elsewhere. Technical difficulty is a problem to resolve, not an automatic indefinite exemption.
A practical recovery procedure should prevent restored copies from silently reintroducing information that should no longer be used. Depending on the system, this may involve controlled restoration, reapplying deletion decisions and checking the result before ordinary access resumes. These are implementation choices directed at an effective outcome, rather than a statutory mandate for one particular technology.
Exports deserve similar attention. A database deletion job cannot remove a spreadsheet that a team saved months earlier unless the organisation knows that copy exists and has a process for handling it. The storage limitation guide develops these operational questions beyond the interpretation of Article 5.
Records and notices must describe the actual position
Under Article 30(1)(f), the controller’s record includes envisaged time limits for erasure of different data categories where possible. That qualification should be preserved when describing the statutory field. A ROPA structure and field guide can help link activities to their rules; it should not be used to claim that Article 30 requires every additional column in a commercial template.
Articles 13 and 14 require information about the period for which personal data will be stored, or, if that is not possible, the criteria used to determine it. A privacy notice should give people useful information rather than merely saying that records will remain for as long as necessary.
The notice, internal schedule and system configuration serve different audiences, but their substance should be consistent. If a notice promises deletion at account closure while the system retains records for another purpose, investigate the mismatch. Correcting the notice does not retrospectively justify unjustified retention, and deleting everything may be inappropriate where a specific law requires preservation.
Erasure requests and routine expiry are separate controls
Storage limitation is a continuing duty even when no person asks for deletion. Article 17 provides an individual right to erasure when its grounds apply, subject to its exceptions. A request may require action before an internal schedule expires, but it does not automatically override a legal retention obligation.
Requests must be handled without undue delay, normally within one month under Article 12. The permitted extension of up to two further months depends on complexity and number of requests, with notice and reasons in the first month. If the controller does not act, it must explain why without delay and at the latest within one month, including complaint and judicial-remedy information.
Article 19 also requires communicating erasure to recipients to whom the personal data were disclosed, unless this proves impossible or involves disproportionate effort, and informing the individual about those recipients if requested. A workflow concerned only with the controller’s main database can therefore miss an important part of the decision.
Demonstrating that the rule works
A data retention policy should connect legal decisions with responsibilities and executable steps. Select representative records, establish their relevant starting events and compare their actual treatment with the stated rule. Examine exceptions as carefully as routine deletions: an unexplained hold can become a permanent store.
Automation can improve reliability at scale, but Article 5 does not prescribe a universal deletion product or quarterly audit timetable. Manual procedures also need to work. The EDPB presents operational examples as guidance, not an exhaustive set of binding implementation commands. The necessary control depends on the process and its risks.
Finally, reconsider retention when purposes change. A new use does not reset the clock merely because a team finds old data valuable. Assess purpose limitation and data minimisation, the applicable legal basis and any additional conditions before repurposing records. The defensible outcome is a specific explanation of why each retained category is still needed, supported by what the organisation actually does.