The defined periods for which data is kept before it is deleted or anonymized, balancing legal duties against minimization.
Data retention is the practice of keeping data only as long as it is needed, then deleting or anonymizing it. Retention periods reflect a balance between legal and contractual obligations to keep certain records and the GDPR principle of storage limitation.
A clear retention schedule, applied consistently, reduces risk and storage cost and demonstrates accountability to regulators.
Related frameworks