Prospect data does not get a retention period just because it sits in your database. Set the period according to why the record entered your system, check whether a legal reason supports keeping it, and record the decision so someone else can test it later. The GDPR does not specify retention periods for different types of data.1 The UK GDPR has no fixed retention period for marketing data.2 A defensible period comes from a purpose you can justify.3 Attach a review and disposal action to that decision.
Purpose
Start with why you use the data. The calendar comes after you know why the record exists and what work still depends on it.
The appropriate retention period depends on the purposes for which the organisation processes personal data.4 Make an inventory of the personal data you hold and why you need it.5 Split that inventory by purpose and data category, then write down what would make each purpose end.
Ask yourself:
- Why do we hold this record?
- Which field is still needed for that purpose?
- What event would show that the purpose has ended?
- Are we holding the same field for another purpose with a separate period?
Move on when each category has a stated purpose and an end condition. If you cannot explain why a record remains in the system, send it to a review that sets the period instead of letting the existing workflow decide for you.
Choose the period
Choose the shortest period that still serves the stated purpose. Give the decision a reason that a colleague can understand without reconstructing the record's history.
Personal data must not be kept longer than it is needed.6 Different data categories require different retention periods.7 Check the statutory obligations that apply before you set the period, because those obligations form part of the retention decision.8
For B2B prospecting, a common practice is to retain data for 24 months from the last meaningful engagement and justify that period in a Legitimate Interests Assessment.9 Use that as a candidate period to assess against your purpose and legal duties. It is a workable starting point only when the record, the engagement trigger, and the reasoning behind the period all match.
When the prospecting purpose ends, ask whether another documented purpose still requires the data. If no purpose remains, move the record to review for disposal.
Record the decision
A retention decision helps only when the team can apply it consistently. Put the rule somewhere people can find, and give the systems enough detail to act on it.
A retention policy should define which data to retain, how long and in what format to retain it, along with the requirements and procedures for deleting data when it is no longer needed.10 Set standard retention periods wherever possible to meet documentation requirements.11
Build a schedule for each category. Record the category, period, trigger, basis, and owner.12 For prospect data, the trigger might be the end of a stated purpose or the last meaningful engagement. Record the chosen period and review it annually.13
Keep the reason beside the period. A bare entry that says "retain for a while" gives the reviewer no way to decide whether the period still fits the purpose.
Review and challenge
Review turns the policy into a working control. Use the trigger you recorded, then inspect the record instead of renewing it automatically.
Periodically review the data you hold, and erase or anonymise it when you no longer need it.14 At review, check whether the purpose continues, whether the trigger has passed, and whether a documented legal reason changes the outcome.
An individual has a right to erasure when the organisation no longer needs the data.15 If someone challenges the retention, carefully consider the challenge against the stated purpose, the chosen period, and any reason for continued storage.16 Record the decision and its basis so the same record does not return to outbound by accident.
The review should end with one clear action: retain for the stated purpose, review under an exception, anonymise, or delete.
Run the disposal
Disposal needs its own procedure. Removing a visible record from a working view does not answer what happened to every copy or report that still contains it.
When the purpose for which information was obtained has ended and the information is no longer required, it must be deleted or disposed of securely.17 Secure deletion can use overwriting, destruction, or anonymisation, and retention controls can be automated in CRM and cloud systems.18
Map where the record appears before you close the action. Check the prospect record, activity history, reports, exports, and other systems that receive the data. Mark the disposal action complete only after the recorded procedure has run across the relevant locations.
Exceptions
A longer period needs a specific reason and a defined scope. Keep the exception attached to the category or matter that requires it, so it does not become a blanket extension for every prospect.
Certain data may need to be retained for legal reasons, including sales records retained for audit by taxing authorities.19 Personal data processed while preparing a legal claim may continue to be stored depending on the institution and the development of the legal proceedings.20
If keeping personal information longer could prejudice the individual or increase the risk and exposure of a data breach, consider safely disposing of it.21 Record what creates the exception, which data it covers, and what event ends it.
What not to do
These mistakes turn a reasonable period into an unmanaged archive.
- Do not keep prospect information merely in case it becomes useful later.22
- Do not leave retention periods as an unwritten team custom. A policy setting standard periods wherever possible supports the documentation requirement.11
- Do not assume that moving a prospect to a recycle bin removes its history. In a prospect system, previous activity and a unique form submission can remain in a report after that action.23