Does GDPR say how long I can keep a lead record?

No. It requires the period to be no longer than necessary for the purpose, and it requires you to disclose either the period or the criteria you use to set it in your privacy information under Articles 13 and 14. The number is yours to justify, not one to look up.

Is anonymised data still subject to retention limits?

Storage limitation applies to data held in a form that permits identification, so genuinely anonymous data falls outside it. The bar is high: if a record can be re-identified using anything you or anyone else holds, it is pseudonymised rather than anonymous and the limits still apply.

Can I keep data indefinitely if someone consented?

No. Consent supports the processing but does not switch off storage limitation, and the two are assessed separately. Data still has to be necessary for the purpose, and consent can be withdrawn at any point, which removes the basis for keeping it at all.

JaxSuite AI

What Is Data Retention?

TL;DR

Data retention is the period an organisation keeps personal data before deleting or anonymising it. GDPR Article 5(1)(e) names no fixed number: it requires that data be kept in a form permitting identification for no longer than is necessary for the purpose, which makes the period something you set, document and can defend.

How do you set a retention period?

Work backwards from the purpose. Ask what makes a record useless: a prospect who never engaged across a full cycle, a contract that ended, an enrichment field that is stale enough to be misleading. Then check whether anything requires you to keep it longer, because tax, employment and contractual record-keeping obligations set their own floors that override a shorter marketing period.

Different categories get different clocks, and the result is a written schedule rather than a single number. Article 5(2) makes accountability the reason: the reasoning has to be recorded somewhere other than in the head of whoever set it up. No regulator publishes a table of correct periods, and no definition page can supply one, which is why the deliverable is a schedule your own adviser is comfortable standing behind.

What does retention look like in an outreach database?

Three awkward categories. Contacts who never replied, where the purpose that justified holding the data has arguably been exhausted. Addresses that hard bounced, which are useless for sending and still personal data. And enrichment attached to a record long after it was accurate, which fails the accuracy principle as well as storage limitation.

Opt-out records run the other way, and this is the exception worth designing for. An address on a suppression list has to survive the deletion of the contact record it came from, otherwise the next import recreates the contact and the person hears from you again. Suppression is the one place where keeping less data creates the bigger compliance problem.

FAQ

Frequently asked questions

No. It requires the period to be no longer than necessary for the purpose, and it requires you to disclose either the period or the criteria you use to set it in your privacy information under Articles 13 and 14. The number is yours to justify, not one to look up.