GDPR Data Retention Guide for Non-EU Businesses

GDPR Article 5(1)(e) requires that personal data be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.” For non-EU businesses, implementing a data retention policy reduces compliance risk, storage costs, and fine exposure.

What the Law Requires

The retention principle has three parts:

• Purpose limitation: You can only retain data as long as the original processing purpose exists
• Periodic review: You must review your retained data at appropriate intervals
• Secure deletion: When retention expires, data must be securely deleted or anonymised

Common Retention Periods by Data Type

• Customer accounts: Retain for the duration of the customer relationship plus reasonable post-termination period (e.g., 90 days for reactivation, then 3-7 years for tax/legal, then delete)
• Contractual records: 5-10 years depending on jurisdiction’s statute of limitations (GDPR doesn’t prescribe specific periods — national law defines them)
• Billing/financial data: 5-10 years (EU tax law requires minimum 5-7 years for VAT records)
• Employee data: Typically 3-5 years after termination (varies by EU member state labour law)
• Cookie/analytics data: 12-26 months maximum (DPA guidance recommends 12 months for analytics)
• Marketing/CRM data: Review every 24 months; delete if consent withdrawn or after 2 years of inactivity

Creating a Data Retention Policy

1. Map your data inventory — what data do you collect, where is it stored, for what purposes?
2. Define retention periods — for each data category, based on legal requirements and business needs
3. Document in your ROPA — Article 30 requires retention criteria as a mandatory field
4. Implement automated deletion — configure systems to delete/anonymise on schedule
5. Review annually — update retention schedules when processing purposes or legal requirements change

Get your EU Rep from EUR 490/year →