Storage limitation is the GDPR principle that data must go away when its job is done. Article 5(1)(e) permits keeping personal data in identifiable form only as long as necessary for the purposes, and Articles 13 and 14 force you to tell people the period, or at least the criteria, up front. The regulation gives almost no fixed numbers, which is precisely what makes retention hard: every period in your schedule needs a reason you can state out loud.
| Regulation | GDPR, Article 5(1)(e) |
|---|---|
| Max penalty | EUR 20M or 4% of global annual turnover |
| Enforcing authority | National supervisory authorities, coordinated by the EDPB |
| Official text | EUR-Lex CELEX 32016R0679 |
Deriving periods that hold up
Work each data category through three questions:
- What does the purpose require? Order data is needed while the order can be disputed or returned; a job application is needed until the role is filled plus a discrimination-claim window.
- What does law require you to keep? National tax and commercial codes set mandatory minimums, commonly 6 to 10 years for financial records. These are lawful-obligation retention, and they beat deletion requests for the covered records.
- What do limitation periods justify? Keeping contract data through the limitation period for claims is a recognized legitimate interest, but only for the data actually needed to defend a claim.
The output is a schedule per data category: the period, the justification, the trigger event (order completion, contract end, last activity), and the deletion mechanism.
Why enforcement happens
The instructive case is Deutsche Wohnen: Berlin’s authority fined the housing company EUR 14.5 million in 2019 because its archive system had no technical capability to delete tenant data, some of it years past any purpose. The lesson is that retention violations are usually architecture problems. Systems that only ever add records, CRM databases with no last-activity purge, and marketing lists that never decay all fail the principle regardless of what the policy document says.
Making deletion actually run
Assign each system an owner and a deletion mechanism: automated purges where the platform supports them, scheduled manual reviews where it does not, and a documented approach for backups. Test the mechanism the way you would test a backup restore, by verifying a record actually disappears end to end, including from search indexes and analytics exports. Log executions; the log is your evidence.
Two adjacent obligations complete the picture. Your privacy notice must disclose the periods or criteria, which is easy to check: run a free scan to see what your public policy currently says. And your records of processing must carry the envisaged periods per activity, so keep the ROPA and the retention schedule synchronized rather than maintaining two diverging documents.