Data retention
Data retention refers to the rules and practices governing how long personal data is kept before it is deleted or anonymised. Under the GDPR the governing principle is storage limitation (Art. 5(1)(e)): data must be kept in identifiable form no longer than necessary for the purposes for which it is processed, with longer retention permitted for archiving in the public interest, scientific or historical research or statistical purposes, subject to appropriate safeguards (Art. 89).
Sector legislation sets specific minimums. Art. 58 of the EU Clinical Trials Regulation 536/2014 requires the sponsor and the investigator to archive the clinical trial master file for at least 25 years after the end of the trial, while subjects' medical files are kept according to national law. The MDR requires technical documentation to be kept for 10 years (15 for implantables) after the last device is placed on the market; pharmacovigilance records are kept for the life of the product plus 10 years; and HIPAA and national health laws add their own periods.
A retention schedule is therefore not a single number but a matrix of data categories, legal bases and periods, documented in the record of processing activities and communicated in information notices. Retention periods also drive vendor contracts, backup configurations and the moment at which a data subject's erasure request can be honoured. Indefinite retention "just in case" is one of the most frequent findings in gap analyses.
