Retention Policies: How Long Can You Keep Customer ...

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Most privacy laws say you must detail your data retention practices in a Privacy Policy. For example, the GDPR specifically requires you to tell people how long you will keep their data, or how you will decide when to delete it. “In cases where you rely on consent to make data processing legal, knowing how long you will keep data is a key part of people being able to make genuinely informed choices about giving consent.” A good balance is to have your Privacy Policy briefly cover the key principles of how you retain data along with a link to your full data retention policy.

   In Consent for B2B marketing

2. Definitions “Clearly explain how you calculate any time periods.” Secondary & Tertiary Data

   In Retention documentation and audits

3. Summary “This can include both the timescales for keeping data and the rationale for deleting it.” A good policy will explain when, how and why you delete data. It will also cover processes such as archiving and anonymizing data. It should help not only ensure consistency in your staff's actions, but prove to people that you handle their personal data responsibly.

   In Retention documentation and audits

4. Reviews “Detail this review process and timescale in your data retention policy.” Anonymization/Pseudonymization

   In Retention documentation and audits

5. In such cases it's good practice to hold on to this data a little longer in case the person who made the request has any follow-up questions or complaints. Data protection regulators around the world give different timescales but keeping the data and extra three to six months will usually be adequate. “If you adopt such an approach, clearly state it in your data retention policy to make sure you and your staff are consistent.” Native goes a step further and suspends data deletion indefinitely:

   In Retention documentation and audits