The General Data Protection Regulation (GDPR) sets strict requirements for organizations that handle EU citizens’ personal data. One key requirement is how long organizations can store personal data. So what exactly are the GDPR’s data storage limits? Here’s a quick overview of the key storage requirements.
How long can you store personal data under GDPR?
GDPR says you can only store personal data for as long as necessary to fulfill your purpose for processing it. This is called “storage limitation”.
Once your purpose is complete, you must delete the data. You can’t keep it indefinitely “just in case” you might need it later.
What purposes allow long-term data storage?
There are some purposes that require long-term data storage, such as:
- Complying with legal obligations – e.g. financial records.
- Performing tasks in the public interest – e.g. medical research.
- Archiving purposes in the public interest – e.g. historical records.
For these purposes, GDPR allows you to store data longer. But you still need policies to delete it eventually.
How long do you have to delete data after your purpose ends?
GDPR doesn’t specify any fixed time limits for deleting data. It just says you must delete it “without undue delay” once your purpose is complete.
To ensure compliance, you should set your own retention schedules based on how long you reasonably need data for your purposes. For example:
- Marketing data – delete within 6 months after a campaign ends.
- HR records – delete 5 years after an employee leaves.
- Product warranty data – delete 10 years from purchase date.
Does GDPR allow any long-term data archiving?
Yes, GDPR makes an exception if you’re archiving personal data for purposes in the public interest, such as scientific or historical research.
To rely on this exception, you must put appropriate safeguards in place. For example, storing archived data securely and limiting staff access to it.
What format should you store personal data in?
GDPR doesn’t dictate what format you should store data in. The main rule is that it must be secure.
Encrypted formats are recommended to protect confidentiality. Common secure formats include:
- Encrypted databases
- Encrypted document storage systems
- Encrypted archival systems
Where should you store personal data under GDPR?
Again, GDPR doesn’t specify where you must store data – only that it must be secure. Some good storage location options include:
- On secure servers in your own data centers.
- In a secure cloud environment.
- On encrypted storage devices.
Does GDPR restrict transferring data outside the EU?
Yes, there are restrictions on transferring EU citizens’ data outside the European Union. You typically need to ensure there are adequate data protection safeguards in place in the destination country.
What are the penalties for breaching GDPR storage rules?
GDPR regulators can impose steep fines if you don’t comply with the storage limitations:
- Up to €10 million or 2% annual global turnover – for basic storage breaches.
- Up to €20 million or 4% annual global turnover – for extensive storage breaches.
Conclusion
To summarize the key GDPR storage requirements:
- Only store personal data for as long as needed for your specific purpose.
- Have policies to delete data when your purpose ends.
- Use secure storage locations and formats.
- Restrict international data transfers outside the EU.
By understanding and complying with GDPR’s storage rules, you can avoid significant fines and protect your customers’ right to privacy.
Examples of GDPR data storage policies
To comply with GDPR’s storage limits, you need to set formal data retention policies and schedules. Here are some examples:
HR data retention policy
- Job applicant records – delete after 1 year.
- Employee performance records – delete after 5 years from end of employment.
- Payroll records – delete after 7 years.
- Pension records – delete 10 years after end of employment.
Marketing data retention policy
- Lead contact info – delete after 1 year if no further engagement.
- Newsletter signup records – delete if unsubscribed for 2 years.
- Webinar registrations – delete after 2 years.
- Customer purchase history – delete after 10 years if inactive.
Support data retention policy
- Support tickets – delete after 2 years if resolved.
- Warranty claims – delete 10 years from product purchase date.
- Forum/community posts – delete after 5 years if inactive.
How to conduct an audit of stored personal data
To comply with GDPR’s storage limits, you should regularly audit your stored personal data. Here are some tips for auditing your data storage:
- Document all systems and locations where personal data is stored.
- Categorize data types (e.g. customer records, mailing lists, support tickets).
- Identify and document your purpose for storing each data type.
- Add expiration timeframes based on how long data is needed for that purpose.
- Implement scripts to automate flagging expired data for deletion.
- Conduct manual checks to find any unflagged stored data past expiration.
- Document when and how expired data is deleted.
- Review your retention policy regularly and update if purposes change.
By auditing your data storage annually or quarterly, you can proactively identify and remove any data stored past its defined purpose.
Using data anonymization to comply with storage limits
One way to comply with GDPR storage limits is anonymizing personal data when you no longer need to identify individuals. This allows you to strip out personal identifiers and keep the data for analysis.
Some techniques to anonymize data include:
- Randomization – Scramble personal details like names and birthdates.
- Aggregation – Group data into statistical averages rather than individual records.
- Truncation – Shorten unique identifiers like account numbers.
- Differential Privacy – Add “noise” to datasets to mask individual entries.
There are also dedicated GDPR anonymization tools you can use to automate anonymizing data upon expiration of your storage period.
Key steps to anonymize stored personal data
- Classify data fields as direct/indirect personal identifiers, content data, etc.
- Select appropriate anonymization techniques for each data field.
- Use tools to automate anonymization when data reaches expiration date.
- Test anonymized datasets to ensure individuals remain unidentifiable.
- Get legal advice to confirm anonymization complies with all privacy regulations.
With proper anonymization, you can satisfy GDPR by removing personal identifiers but still retaining useful data for analysis.
Using encryption and pseudonymization to anonymize data
Encryption and pseudonymization are two key techniques for anonymizing personal data under GDPR.
Encryption
Encryption encodes data so only authorized parties can read it. It prevents unauthorized access to personal information.
GDPR considers properly encrypted data as anonymous since the individuals are unidentifiable.
Pseudonymization
This replaces direct identifiers (like names) with artificial identifiers (like reference numbers). The mapping between pseudonyms and real IDs is stored separately and kept secure.
GDPR considers properly pseudonymized data as anonymous since the individuals are unidentifiable without the mapping.
Benefits
- Allows analyzing useful data without identifying individuals.
- Complies with GDPR anonymization requirements.
- Lower risk than fully anonymous data which can’t be traced back if needed.
Limitations
- Requires mapping data securely which takes resources.
- Small sample sizes may still allow re-identification.
- May still need consent for processing anonymized datasets.
When implemented properly, encryption and pseudonymization enable compliant use of anonymized personal data under GDPR limits.
Best practices for deleting data under GDPR
Simply flagging data for deletion isn’t enough to comply with GDPR. You need to use effective deletion methods. Here are some best practices:
Permanently erase files and databases
Don’t just move files to trash – actually overwrite or wipe the data. Use secure deletion tools and methods.
Destroy physical media
Shred paper records. Disintegrate CDs/DVDs. Melt flash drives. Completely destroy media.
Remove from backups
Expired data shouldn’t remain tucked away on your backups. Remove from all backup locations.
Update hashed data
If personal data is hashed for security, generate new hash values to replace real data.
Document everything
Keep detailed records of when and how data is deleted to prove compliance.
Confirm destruction
Do sample checks to confirm data no longer exists after deletion procedures complete.
Following best practices for secure data destruction ensures GDPR compliance and minimizes leftover personal data risks.
Should you inform individuals when deleting their data?
GDPR does not require informing individuals when you delete their data. However, it’s often considered best practice to notify them.
Why notify individuals?
- Shows compliance and care for personal privacy.
- Increases trust and transparency.
- Prevents mistaken attempts by individuals to access deleted data.
- Legal basis for deleting data is more justifiable.
Why not notify individuals?
- Adds administrative burden.
- Individuals may not want notifications.
- Risk of accidentally leaking personal data if insecure channels used.
- Deletion may be automated making individual notifications infeasible.
Alternatives to direct notification
- Generic privacy policy explaining your data deletion practices.
- Notification to trusted third party representatives.
- Central public register of deleted data sets.
There are reasonable cases for and against notifying individuals of data deletion, so organizations should strike the right balance for their situation.
Should you obtain consent before deleting individuals’ data?
No, GDPR does not require consent before deleting personal data in most cases. The main exceptions are:
- Data processed only on the legal basis of consent – deletion requires consent.
- Deleting data may violate contractual requirements or rights.
- National laws may require consent for public interest archiving.
In general, organizations don’t need consent to delete personal data if:
- Processing was based on legitimate interests, legal obligation etc.
- Deletion is necessary to comply with GDPR storage limits.
- Individuals were informed of automated deletion in privacy notices.
Seeking consent provides an extra assurance, but shouldn’t be mandatory if you already have a lawful basis for deleting expired data under GDPR.
What steps should organizations take to comply with GDPR data storage requirements?
Here is a checklist of key steps organizations should take to comply with GDPR data storage rules:
- Document all personal data storage locations.
- Analyze data flows and map data lifecycles.
- Identify and document legal bases for processing each data type.
- Define and set storage limits aligned to processing purposes.
- Implement mechanisms to flag data for deletion.
- Use secure deletion methods to permanently erase expired data.
- Anonymize personal data needing archival past limits.
- Add data deletion details into privacy notices.
- Train staff on secure data deletion procedures.
- Conduct periodic storage audits.
Taking a methodical approach to implementing GDPR storage compliance requirements reduces data protection risks.
Common mistakes organizations make with GDPR data storage
Some common mistakes that put organizations at risk of violating GDPR storage requirements include:
- No defined data retention schedules.
- Unlimited “just in case” data retention.
- Weak deletion procedures leaving data recoverable.
- Failing to update backups and archived data.
- Anonymizing without proper controls and testing.
- Storing personal data without a lawful basis.
- Inadequate consent practices for optional deletion requests.
- Not documenting deletion implementation for audits.
Organizations should analyze their current data retention practices against GDPR guidance to identify and fix any gaps or non-compliant processes.
Key takeaways
- Only retain personal data for as long as needed for your specific processing purpose.
- Have policies to securely delete data when no longer required.
- Use lawful methods like encryption and anonymization for long-term archiving.
- Document compliant storage practices ready for regulators’ audits.
GDPR creates strict obligations for organizations to delete expired personal data in a secure and responsible manner. Meeting these data storage requirements takes planning and resources, but helps build customer trust and prevent data misuse.
