Data retention is the period during which a company keeps data, after which deletion or anonymisation should follow. The periods arise from several sources: accounting and tax regulations, the labour code, archiving obligations, and, for personal data, the principle that it should not be kept for longer than is necessary for the given purpose. For a company, this is a practical form of protection – data that no longer exists cannot leak. Implementing it requires setting periods for individual categories of data, recording them in the records of processing activities, and ensuring their technical execution, including backups, which are the thing most often forgotten. It is worth setting this up automatically, because in practice manual deletion is never carried out consistently.
See also: Records of processing activities, Anonymisation and Pseudonymisation, Archiving of project documentation.
