For regulated firms across Europe, holding on to data “just in case” has become a liability. Supervisors, auditors and customers increasingly want to know why an organisation still holds a given record. A well-built data retention policy is how firms answer.
A data retention policy is a documented framework that sets how long each category of data is kept, the reason for that period, and how the data is destroyed once it ends. Its foundation in the EU is the storage limitation principle in Article 5(1)(e) of the GDPR, remarked Copla.
Under that principle, personal data can be kept in identifiable form only as long as its original purpose requires. The regulation does not specify a number of years, so each organisation must set, justify and enforce its own periods.
The stakes are significant. Holding personal data beyond its purpose breaches GDPR even if no leak ever happens, and violations of the Article 5 principles fall into the top fine tier: up to €20m or 4% of global annual turnover, whichever is higher.
In June 2026, a Berlin court found that property company Deutsche Wohnen had intentionally failed to update its systems in time to delete former tenants’ payslips, bank statements and identity documents. The court imposed a €900,000 fine, well below the roughly €14.5m originally set by the data protection authority in 2019, and the ruling is not yet final.
Firms also need to separate three often-confused ideas. Retention is the rule for how long data is kept. Archiving moves data into cheaper, restricted storage, but the retention clock keeps running. Deletion means permanent removal from live systems and backups. Simply hiding a record from users is not deletion.
The wider regulatory picture adds complexity. The Digital Operational Resilience Act (DORA) requires financial entities to maintain a register of information on ICT third-party arrangements, yet sets no retention period for its entries.
The NIS2 Directive likewise sets no period for logs, leaving national laws to fill the gap: Lithuania requires at least 90 days for log records, while the Czech Republic demands 18 months for some regulated services. ISO 27001 leaves periods to an organisation’s own procedure, and auditors will test firms against what they have written down.
Retention benchmarks therefore vary widely. Accounting records range from five years in Denmark to ten in Germany, France, Italy and Lithuania, while anti-money laundering records must be kept for five years after a business relationship ends.
Every period needs both a length and a trigger event, and getting the trigger wrong can mean deleting files too early or keeping them far too long.
An effective policy covers scope, data categories, a detailed schedule, storage and security, deletion methods, legal holds, ownership and at least annual review. Firms should classify their data first, document the legal basis for each period, automate deletion where possible and assign clear owners. Ultimately, a retention policy proves nothing until there is evidence that it is being followed.
Read the full Copla post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
